Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578446
MD5:	f8fc64f50be9ac7c2757ae0dc1fecae9
SHA1:	a8548a7fe4db8133e0287aa0e0e30c22bd607268
SHA256:	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F8FC64F50BE9AC7C2757AE0DC1FECAE9)

skotes.exe (PID: 7520 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F8FC64F50BE9AC7C2757AE0DC1FECAE9)

skotes.exe (PID: 8104 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F8FC64F50BE9AC7C2757AE0DC1FECAE9)

65996c3e29.exe (PID: 5820 cmdline: "C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe" MD5: 25FB9C54265BBACC7A055174479F0B70)

2fdda55cb5.exe (PID: 7352 cmdline: "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

2fdda55cb5.exe (PID: 3848 cmdline: "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe" MD5: EF08A45833A7D881C90DED1952F96CB4)

4c87a5a549.exe (PID: 7704 cmdline: "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe" MD5: DBF748514EB0FC59B54EEC27DA278552)

32e4f1cc69.exe (PID: 7860 cmdline: "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe" MD5: 87EBB8C3E3EC5A31C8D50C80357F18AE)

chrome.exe (PID: 1276 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2148,i,17586504940363109766,5226812246577533475,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

4e8d32508c.exe (PID: 7952 cmdline: "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe" MD5: FC3C8F3D665C9EB3D905AEA87362077D)

taskkill.exe (PID: 3732 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4940 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6604 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6888 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6572 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7744 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

f465aceff1.exe (PID: 4440 cmdline: "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe" MD5: 76A8BF3F8832AD9EA271581CF46BE4B0)

cf64a9d6bd.exe (PID: 2996 cmdline: "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe" MD5: 04F57C6FB2B2CD8DCC4B38E4A93D4366)

conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3632 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5456 cmdline: "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

197a50e0cf.exe (PID: 5268 cmdline: "C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 4452 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 2364 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 7888 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 736 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4228 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

b236e8b839.exe (PID: 5352 cmdline: "C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe" MD5: FF279F4E5B1C6FBDA804D2437C2DBDC8)

4c87a5a549.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe" MD5: DBF748514EB0FC59B54EEC27DA278552)

4c87a5a549.exe (PID: 6156 cmdline: "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe" MD5: DBF748514EB0FC59B54EEC27DA278552)

firefox.exe (PID: 8052 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 8100 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7496 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a220cca7-9a24-45c9-9dc1-cb9c5bbde0e6} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 2202116ed10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4012 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3768 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fef79822-522c-4b3e-9b9c-fe49e006e0b7} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 220339fa110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

32e4f1cc69.exe (PID: 7640 cmdline: "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe" MD5: 87EBB8C3E3EC5A31C8D50C80357F18AE)

4e8d32508c.exe (PID: 6536 cmdline: "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe" MD5: FC3C8F3D665C9EB3D905AEA87362077D)

taskkill.exe (PID: 6888 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4304 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8112 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7056 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

f465aceff1.exe (PID: 4280 cmdline: "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe" MD5: 76A8BF3F8832AD9EA271581CF46BE4B0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["crosshuaht.lat", "aspecteirs.lat", "sustainskelet.lat", "rapeflowwj.lat", "sweepyribs.lat", "grannyejh.lat", "energyaffai.lat", "necklacebudi.lat", "discokeyus.lat"], "Build id": "PsFKDg--pablo"}

Threatname: Vidar

{"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.2596786814.0000000005860000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.2590927332.0000000003513000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000022.00000003.2900882871.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000034.00000003.3520830366.0000000000A33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1720825276.0000000005040000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000002.3246036517.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.3493290951.0000000001718000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000002.3246036517.00000000038DB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000003.3203898816.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000034.00000003.3515342718.0000000000A33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2312159104.00000000046D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000022.00000002.3295527171.00000000007E1000.00000040.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.3219956673.00000000007E1000.00000040.00000001.01000000.00000013.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000003.3212168666.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.3492616015.00000000016FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1689016313.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000002.3306873384.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2697039988.0000000004E20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 2fdda55cb5.exe PID: 7352	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 2fdda55cb5.exe PID: 3848	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 4c87a5a549.exe PID: 7704	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4c87a5a549.exe PID: 7704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4c87a5a549.exe PID: 7704	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 32e4f1cc69.exe PID: 7860	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 32e4f1cc69.exe PID: 7860	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 32e4f1cc69.exe PID: 7860	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 32e4f1cc69.exe PID: 7860	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4e8d32508c.exe PID: 7952	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 4c87a5a549.exe PID: 6156	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4c87a5a549.exe PID: 6156	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.2fdda55cb5.exe.5860000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.2fdda55cb5.exe.431d790.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.skotes.exe.890000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.520000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8104, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4c87a5a549.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe, ParentProcessId: 2996, ParentProcessName: cf64a9d6bd.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", ProcessId: 3632, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe, ParentProcessId: 7860, ParentProcessName: 32e4f1cc69.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 1276, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8104, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4c87a5a549.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", CommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe, ParentProcessId: 2996, ParentProcessName: cf64a9d6bd.exe, ProcessCommandLine: "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex", ProcessId: 3632, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000023.00000002.3246036517.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://www.microsoft.com0", "Botnet": "1402"}
Source: 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 4c87a5a549.exe.6156.21.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["crosshuaht.lat", "aspecteirs.lat", "sustainskelet.lat", "rapeflowwj.lat", "sweepyribs.lat", "grannyejh.lat", "energyaffai.lat", "necklacebudi.lat", "discokeyus.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: crosshuaht.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: sustainskelet.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: aspecteirs.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: energyaffai.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: necklacebudi.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: discokeyus.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: grannyejh.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: sweepyribs.lat
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: Workgroup: -
Source: 0000000D.00000002.3327657554.0000000000A01000.00000040.00000001.01000000.00000012.sdmp	String decryptor: PsFKDg--pablo

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: 32e4f1cc69.exe, 0000000C.00000002.3276622619.0000000068B5D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: nss3.pdb@ source: 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: mozglue.pdb source: 32e4f1cc69.exe, 0000000C.00000002.3276622619.0000000068B5D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: protobuf-net.pdb source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: number of queries: 2002

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 4x nop then jmp 02C15B19h		8_2_02C15193
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 4x nop then jmp 02C15B19h		8_2_02C1516B

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 188MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: http://www.microsoft.com0
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0052E0C0 recv,recv,recv,recv,

0_2_0052E0C0

Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlYou must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3041745151.0000022031687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: firefox.exe, 0000001E.00000002.3083963410.0000022038EAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3076316321.00000220345E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 4c87a5a549.exe, 0000000B.00000003.3514150101.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeP
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exem
Source: 4c87a5a549.exe, 0000000B.00000003.3514150101.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/z
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000947000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllC
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll3
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll7
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllO
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000947000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpox
Source: 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp36
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/j
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://185.215.113.206Local79229cb002.phpinit.exe
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000947000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpa0b401ee87786552f19b0a8311c3release
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 65996c3e29.exe, 00000006.00000003.2487224670.000000000134D000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487376905.000000000135C000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3333958401.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3288438246.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2653233136.00000000007CA000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3213436353.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3334112057.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001E.00000002.3061765423.000002203271C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001E.00000003.2996962592.00000220344AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_REQUEST_BODY_SENT_startDetection/urlF
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001E.00000002.3006342790.0000022021103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#http://json-schema.org/draft-06/schema#getDetectedLanguages/l
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#https://json-schema.org/draft/2019-09/schemahttps://json-sche
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3059952509.000002203256E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCaphttp://mozilla.org/#/properties/autoFillA
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appIdhttp://mozilla.org/#/properties/channelhttp://mozilla.org/#/pro
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsresource://gre/modul
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slughttp://mozilla.org/#/propertie
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/countPublic
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/startbrowser.safebrowsing.provider.mozilla.g
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDatehttp://mozilla.org/#/properties/merinoEndpointURLre
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/branches/anyOf/0http
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOuthttp://mozilla.org/#/properties/branches/anyO
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPausedUPDATE_CHECK_EXTENDED_ERROR_EXTERNAL
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1http://mozilla.org/#/properties/localizations/a
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizationsresource://gre/modules/Timer.sys.mjs
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slugbrowser.safebrowsing.provider.test.dis
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/itemshttp://mozilla.org/#/properties/featureIds/itemshttp:/
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/outcomes
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestionshttp://mozilla.org/#/propertie
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersionBranch
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slughttp://mozilla.org/#/properties/idhttp://mozilla.org/#/propertie
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 0000001E.00000002.3076316321.0000022034567000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3037616918.00000220311F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2902427330.000002203901B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3029381877.0000022030B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3037616918.00000220311D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2950124621.00000220311D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3030877491.0000022030C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2922883245.00000220332DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2841838208.00000220311D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3038170837.0000022031296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075619451.0000022034505000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3088425296.0000022039018000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2950124621.00000220311B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3085916670.0000022038F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2950124621.00000220311D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2839101704.0000022031187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075619451.0000022034541000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3086873089.0000022038F6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2991579244.000002203ABEA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2936226561.0000022032981000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3037616918.00000220311D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001E.00000002.3066398725.0000022033194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071857687.0000022033924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000001E.00000002.3066398725.0000022033194000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3071857687.0000022033924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 32e4f1cc69.exe, 0000000C.00000002.3276622619.0000000068B5D000.00000002.00000001.01000000.00000020.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001E.00000002.3029381877.0000022030B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3038170837.0000022031296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3104200365.000002230003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3013654008.000002202D3C0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069288348.000002203343B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3069288348.0000022033489000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3013654008.000002202D39E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2945554696.00000220334B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#shouldDisplayRemovalOfEngineNotificati
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D39E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3013654008.000002202D39E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulReturning
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D39E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulprefEmailTrackingProtectionEnabledInPri
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PrivateBrowsingU
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 32e4f1cc69.exe, 0000000C.00000002.3275980414.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001E.00000002.3085916670.0000022038F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001E.00000003.2993205789.0000022038FF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3061765423.0000022032779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001E.00000002.3061765423.0000022032779000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdL
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3041745151.0000022031687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: 2fdda55cb5.exe, 00000008.00000000.2503348529.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/
Source: 2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/accountname.aspx
Source: 2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/balance.aspx
Source: 2fdda55cb5.exe, 00000008.00000000.2503348529.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspx
Source: 2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/history.aspxS
Source: 2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://archive.torproject.org/tor-package-archive/torbrowser/13.0.9/tor-expert-bundle-windows-i686-
Source: 4c87a5a549.exe, 0000000D.00000003.3326905136.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000003.3325641369.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3334117584.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.000000000153F000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001532000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/
Source: 4c87a5a549.exe, 0000000D.00000002.3334117584.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/api
Source: 4c87a5a549.exe, 0000000D.00000003.3326905136.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3334117584.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/api-j
Source: 4c87a5a549.exe, 0000000D.00000003.3326905136.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3334117584.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat/apiUj
Source: 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat:443/api
Source: 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aspecteirs.lat:443/api:
Source: firefox.exe, 0000001E.00000003.2916310934.00000220394BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001E.00000003.2916310934.00000220394BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001E.00000002.3083963410.0000022038EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001E.00000002.3066061590.0000022033003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001E.00000002.3041745151.0000022031652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/api5I
Source: firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3104620250.0000062B08104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://energyaffai.lat:443/api
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001E.00000003.2931493505.00000220325AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001E.00000002.3010231319.000002202CAFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203663419.0000000005474000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/%
Source: 4c87a5a549.exe, 0000000B.00000003.2653394884.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat//
Source: 4c87a5a549.exe, 0000000B.00000003.2702813808.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2702548176.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204876642.000000000547B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3312584068.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2704627256.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3285910032.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3311434181.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204394478.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3296560979.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203663419.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/1
Source: 4c87a5a549.exe, 0000000B.00000003.3336288412.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/Z
Source: 4c87a5a549.exe, 4c87a5a549.exe, 0000000B.00000003.2702813808.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2702548176.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3288438246.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3312584068.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2653233136.000000000077B000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3336288412.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2704627256.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3213066339.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3285910032.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3311434181.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3214533700.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2653233136.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3336736640.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3296560979.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: 4c87a5a549.exe, 0000000B.00000003.3336736640.0000000000785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiIW
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiLI
Source: 4c87a5a549.exe, 0000000B.00000003.3213066339.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3214533700.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiME=jone
Source: 4c87a5a549.exe, 0000000B.00000003.3204876642.000000000547B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3312584068.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3285910032.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3311434181.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204394478.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3296560979.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203663419.0000000005474000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiO
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiP
Source: 4c87a5a549.exe, 0000000B.00000003.2679943422.000000000547D000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2679103467.000000000546E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiU
Source: 4c87a5a549.exe, 0000000B.00000003.3288438246.0000000000785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apicx
Source: 4c87a5a549.exe, 0000000B.00000003.3285678585.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3288267318.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/k
Source: 4c87a5a549.exe, 0000000B.00000003.3336288412.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/o
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/t
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2653233136.000000000077B000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001E.00000002.3010231319.000002202CABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001E.00000002.3071857687.0000022033924000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001E.00000002.3006342790.0000022021103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052763404.00000220322BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001E.00000002.3029381877.0000022030B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DFCC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3018578578.000002202E11F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: 4c87a5a549.exe, 00000015.00000003.3427280051.000000000177B000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3465636895.000000000177D000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/))
Source: 4c87a5a549.exe, 00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/0
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/2
Source: 4c87a5a549.exe, 00000015.00000003.3466901864.000000000177D000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3472022362.000000000177D000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3465636895.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/8
Source: 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api
Source: 4c87a5a549.exe, 00000015.00000003.3430725093.0000000005CC2000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3465636895.0000000001784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api(
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api/
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api2b
Source: 4c87a5a549.exe, 00000015.00000003.3427970926.0000000005CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/api4
Source: 4c87a5a549.exe, 00000015.00000003.3427280051.0000000001784000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/apit
Source: 4c87a5a549.exe, 00000015.00000003.3465636895.000000000177D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat/v
Source: 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat:443/api
Source: 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat:443/api.H7
Source: 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat:443/api2o4p.default-release/key4.dbPK
Source: 4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacebudi.lat:443/apid
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001E.00000002.3083963410.0000022038EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: 2fdda55cb5.exe, 00000008.00000000.2503348529.0000000000982000.00000002.00000001.01000000.0000000A.sdmp, 2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com0
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001E.00000002.3052763404.00000220322D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2925506213.00000220322D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001E.00000002.3052763404.00000220322D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2925506213.00000220322D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001E.00000002.3093351980.00000220391F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001E.00000003.2942680167.00000220391D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3041745151.0000022031687000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 4c87a5a549.exe, 0000000B.00000003.2655435499.00000000054C0000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3355895431.0000000005D65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001E.00000003.2944076298.00000220335B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3063248884.0000022032884000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helphttps://support.mozi
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001E.00000002.3073737646.0000022033AE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2957301779.0000022033ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001E.00000003.2994610003.0000022034591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causestoolbar-menubar
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/ExtensionPermissions.sys.mj
Source: 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 32e4f1cc69.exe, 0000000C.00000003.3068471942.0000000011B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 4c87a5a549.exe, 0000000B.00000003.2655511930.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2655435499.00000000054C0000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2678984619.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2895796051.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3388556500.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3394168841.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3355895431.0000000005D63000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3356380554.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3381150149.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 4c87a5a549.exe, 0000000B.00000003.2655511930.0000000005494000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3356380554.0000000005CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 4c87a5a549.exe, 0000000B.00000003.2655511930.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2655435499.00000000054C0000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2678984619.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2895796051.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3388556500.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3394168841.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3355895431.0000000005D63000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3356380554.0000000005D17000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3381150149.0000000005D17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 4c87a5a549.exe, 0000000B.00000003.2655511930.0000000005494000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3356380554.0000000005CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: 65996c3e29.exe, 00000006.00000003.2487394554.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487499130.0000000001314000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487394554.000000000130A000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488344508.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/
Source: 65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488344508.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: 65996c3e29.exe, 00000006.00000003.2487499130.0000000001314000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487394554.000000000130A000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/apic
Source: 65996c3e29.exe, 00000006.00000003.2487394554.00000000012F3000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488344508.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001E.00000002.3015486112.000002202DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001E.00000002.3029381877.0000022030B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052763404.00000220322D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2925506213.00000220322D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001E.00000002.3030877491.0000022030CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001E.00000003.2942680167.000002203918E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052763404.00000220322D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2925506213.00000220322D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/UpdateService:_postUpdateProcessing
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.2999878096.00000076733AC000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2941476978.00000220394F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000001E.00000003.2931493505.00000220325AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/urlclassifier.features.socialtracking.annotate.whi
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 4c87a5a549.exe, 0000000B.00000003.2704772933.000000000557F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.3068471942.0000000011B4F000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3099790424.00000220394D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C95F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 4c87a5a549.exe, 0000000B.00000003.2704772933.000000000557F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.3068471942.0000000011B4F000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000001E.00000002.2999878096.00000076733AC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001E.00000002.3010231319.000002202CABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001E.00000002.3041745151.0000022031652000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D2AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3098632750.0000022039436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001E.00000003.2945554696.00000220334B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001E.00000002.3071857687.0000022033924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2945554696.00000220334B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001E.00000003.2945554696.00000220334B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001C.00000002.2815328137.00000291935FA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.2822803432.0000016B05AAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdchrome://global/cont
Source: firefox.exe, 0000001E.00000002.3044937144.000002203181B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accounteNewlinesReplaceWithCommas_getBoundsWithoutFlushingensureUnloadHandlerReg

System Summary

.NET source code contains very large array initializations

Source: 8.2.2fdda55cb5.exe.494ce18.2.raw.unpack, Aexb5XGUHWH0ZbfQ2k.cs

Large array initialization: PYRp7SOSm: array initializer size 360688

Binary is likely a compiled AutoIt script file

Source: 4e8d32508c.exe, 0000000E.00000000.2759063792.00000000004E2000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_443b6bbd-2
Source: 4e8d32508c.exe, 0000000E.00000000.2759063792.00000000004E2000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_2bc72b3a-4

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: 65996c3e29.exe.5.dr	Static PE information: section name:
Source: 65996c3e29.exe.5.dr	Static PE information: section name: .idata
Source: 65996c3e29.exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: f465aceff1.exe.5.dr	Static PE information: section name:
Source: f465aceff1.exe.5.dr	Static PE information: section name: .idata
Source: f465aceff1.exe.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: 4c87a5a549.exe.5.dr	Static PE information: section name:
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: .idata
Source: 4c87a5a549.exe.5.dr	Static PE information: section name:
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name:
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00567049	0_2_00567049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00568860	0_2_00568860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005678BB	0_2_005678BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00638101	0_2_00638101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005631A8	0_2_005631A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00524B30	0_2_00524B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00562D10	0_2_00562D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00524DE0	0_2_00524DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00557F36	0_2_00557F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056779B	0_2_0056779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D78BB	1_2_008D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D7049	1_2_008D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D8860	1_2_008D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D31A8	1_2_008D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00894B30	1_2_00894B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00894DE0	1_2_00894DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D2D10	1_2_008D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008D779B	1_2_008D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008C7F36	1_2_008C7F36
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D2310	8_2_011D2310
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D0F38	8_2_011D0F38
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D2160	8_2_011D2160
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D2014	8_2_011D2014
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D20AA	8_2_011D20AA
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D2C5A	8_2_011D2C5A
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D2C60	8_2_011D2C60
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D0E8D	8_2_011D0E8D
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D3740	8_2_011D3740
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D3648	8_2_011D3648
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1B5F	8_2_011D1B5F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1AFA	8_2_011D1AFA
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1D69	8_2_011D1D69
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1DEA	8_2_011D1DEA
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1CB1	8_2_011D1CB1
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1FBF	8_2_011D1FBF
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_011D1E9E	8_2_011D1E9E
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C11088	8_2_02C11088
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C110A0	8_2_02C110A0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C13029	8_2_02C13029
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C13038	8_2_02C13038
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C11910	8_2_02C11910
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C114D8	8_2_02C114D8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C12C00	8_2_02C12C00
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_02C18528	8_2_02C18528
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F92106	8_2_09F92106
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9A514	8_2_09F9A514
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9BD98	8_2_09F9BD98
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F92FC0	8_2_09F92FC0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B0B90	8_2_0B4B0B90
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B7F70	8_2_0B4B7F70
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B1E88	8_2_0B4B1E88
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B9E98	8_2_0B4B9E98
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B2CF8	8_2_0B4B2CF8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B9598	8_2_0B4B9598
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B1450	8_2_0B4B1450
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B3BD8	8_2_0B4B3BD8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B3BD7	8_2_0B4B3BD7
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B2BE0	8_2_0B4B2BE0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B0AF2	8_2_0B4B0AF2
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8950	8_2_0B4B8950
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8960	8_2_0B4B8960
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B18D8	8_2_0B4B18D8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B18E8	8_2_0B4B18E8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B7F6F	8_2_0B4B7F6F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B4FE8	8_2_0B4B4FE8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B4FE0	8_2_0B4B4FE0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B9E88	8_2_0B4B9E88
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B1E87	8_2_0B4B1E87
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8D10	8_2_0B4B8D10
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8D20	8_2_0B4B8D20
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B4DDF	8_2_0B4B4DDF
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B4DE0	8_2_0B4B4DE0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B2C10	8_2_0B4B2C10
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B5278	8_2_0B4B5278
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B5270	8_2_0B4B5270
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8218	8_2_0B4B8218
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8228	8_2_0B4B8228
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B0040	8_2_0B4B0040
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B0006	8_2_0B4B0006
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8558	8_2_0B4B8558
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B8568	8_2_0B4B8568
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B9588	8_2_0B4B9588
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B5449	8_2_0B4B5449
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4BA448	8_2_0B4BA448
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B1441	8_2_0B4B1441
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4BA447	8_2_0B4BA447
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B5458	8_2_0B4B5458
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_0180A3A8	10_2_0180A3A8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_018021B0	10_2_018021B0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_018021C0	10_2_018021C0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059617D0	10_2_059617D0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05962878	10_2_05962878
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05961B07	10_2_05961B07
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05977F38	10_2_05977F38
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05973F50	10_2_05973F50
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05974613	10_2_05974613
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05977668	10_2_05977668
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_0597489F	10_2_0597489F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_0597426F	10_2_0597426F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059745B0	10_2_059745B0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059745BC	10_2_059745BC
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059745EA	10_2_059745EA
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05973F50	10_2_05973F50
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05973F86	10_2_05973F86
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05973F43	10_2_05973F43
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059749E1	10_2_059749E1
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059723D8	10_2_059723D8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05977320	10_2_05977320
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059742F4	10_2_059742F4
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_0597421D	10_2_0597421D
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05974A01	10_2_05974A01
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05974229	10_2_05974229
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059849A0	10_2_059849A0
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059899F8	10_2_059899F8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05988E88	10_2_05988E88
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05988E79	10_2_05988E79
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05984990	10_2_05984990
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_059899E8	10_2_059899E8
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_05989B7B	10_2_05989B7B
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00795B00	11_3_00795B00
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00795B00	11_3_00795B00
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00795B00	11_3_00795B00
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00795B00	11_3_00795B00

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005380C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 008A80C0 appears 130 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe0.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2fdda55cb5.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9977594942098093
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9977594942098093
Source: random[1].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: random[1].exe.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: 65996c3e29.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: 65996c3e29.exe.5.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: random[2].exe.5.dr	Static PE information: Section: mepijjqp ZLIB complexity 0.9948418633619436
Source: f465aceff1.exe.5.dr	Static PE information: Section: mepijjqp ZLIB complexity 0.9948418633619436
Source: 4c87a5a549.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9974114404965754
Source: 4c87a5a549.exe.5.dr	Static PE information: Section: mjanwrqb ZLIB complexity 0.9949600805530164
Source: random[2].exe1.5.dr	Static PE information: Section: mlmzcfis ZLIB complexity 0.9948050721799463

Source: random[2].exe1.5.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: cf64a9d6bd.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: cf64a9d6bd.exe.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.SetAccessControl
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	Security API names: _0020.AddAccessRule
Source: random[2].exe0.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[2].exe0.5.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@115/27@0/26

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Mutant created: \Sessions\1\BaseNamedObjects\80065eb12166c1a5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 4c87a5a549.exe, 0000000B.00000003.2679103467.0000000005461000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654821342.0000000005498000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2906486941.00000000058A8000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3351569749.0000000005CF6000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3381989732.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 32e4f1cc69.exe, 0000000C.00000002.3266213299.00000000059D4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3275656955.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 65996c3e29.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe "C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2148,i,17586504940363109766,5226812246577533475,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a220cca7-9a24-45c9-9dc1-cb9c5bbde0e6} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 2202116ed10 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3768 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fef79822-522c-4b3e-9b9c-fe49e006e0b7} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 220339fa110 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe "C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"
Source: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe "C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe "C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe "C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe "C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2148,i,17586504940363109766,5226812246577533475,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a220cca7-9a24-45c9-9dc1-cb9c5bbde0e6} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 2202116ed10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3768 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fef79822-522c-4b3e-9b9c-fe49e006e0b7} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 220339fa110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Section loaded: winhttp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 3016192 > 1048576

Source: file.exe

Static PE information: Raw size of qokzkhtc is bigger than: 0x100000 < 0x2aec00

Source:	Binary string: mozglue.pdbP source: 32e4f1cc69.exe, 0000000C.00000002.3276622619.0000000068B5D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: nss3.pdb@ source: 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 32e4f1cc69.exe, 0000000C.00000002.3277598141.0000000068D1F000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: mozglue.pdb source: 32e4f1cc69.exe, 0000000C.00000002.3276622619.0000000068B5D000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: protobuf-net.pdb source: 2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.520000.0.unpack :EW;.rsrc:W;.idata :W;qokzkhtc:EW;cvovnsld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qokzkhtc:EW;cvovnsld:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.890000.0.unpack :EW;.rsrc:W;.idata :W;qokzkhtc:EW;cvovnsld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qokzkhtc:EW;cvovnsld:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Unpacked PE file: 6.2.65996c3e29.exe.690000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Unpacked PE file: 12.2.32e4f1cc69.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W;wokzrztg:EW;eojqxzlp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wokzrztg:EW;eojqxzlp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Unpacked PE file: 13.2.4c87a5a549.exe.a00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mjanwrqb:EW;poqismoi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mjanwrqb:EW;poqismoi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Unpacked PE file: 32.2.f465aceff1.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mepijjqp:EW;sxjadjho:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Unpacked PE file: 34.2.32e4f1cc69.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W;wokzrztg:EW;eojqxzlp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wokzrztg:EW;eojqxzlp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Unpacked PE file: 46.2.f465aceff1.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mepijjqp:EW;sxjadjho:EW;.taggant:EW; vs :ER;.rsrc:W;

.NET source code contains potential unpacker

Source: 8.2.2fdda55cb5.exe.4605b78.1.raw.unpack, MainForm.cs	.Net Code: _202B_200C_200F_200D_200D_202A_206D_202C_200B_200E_202B_206E_206B_206B_206E_200B_200F_206E_200E_202E_200F_202A_200D_200B_206C_206B_200F_200B_200C_206A_206A_200F_202E_200C_206E_200F_206C_206D_202D_202B_202E System.Reflection.Assembly.Load(byte[])
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	.Net Code: b0a6Vp3JoK System.Reflection.Assembly.Load(byte[])
Source: 8.2.2fdda55cb5.exe.4625b98.0.raw.unpack, MainForm.cs	.Net Code: _202B_200C_200F_200D_200D_202A_206D_202C_200B_200E_202B_206E_206B_206B_206E_200B_200F_206E_200E_202E_200F_202A_200D_200B_206C_206B_200F_200B_200C_206A_206A_200F_202E_200C_206E_200F_206C_206D_202D_202B_202E System.Reflection.Assembly.Load(byte[])

Yara detected Costura Assembly Loader

Source: Yara match	File source: 10.2.2fdda55cb5.exe.5860000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.2fdda55cb5.exe.431d790.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2596786814.0000000005860000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2590927332.0000000003513000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2fdda55cb5.exe PID: 3848, type: MEMORYSTR

Source: random[2].exe0.5.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: random[1].exe1.5.dr	Static PE information: real checksum: 0x2d011b should be: 0x2d594a
Source: 4c87a5a549.exe.5.dr	Static PE information: real checksum: 0x1cf00c should be: 0x1c8763
Source: 32e4f1cc69.exe.5.dr	Static PE information: real checksum: 0x2c8e61 should be: 0x2bf5d8
Source: random[2].exe0.5.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: 2fdda55cb5.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: cf64a9d6bd.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: 65996c3e29.exe.5.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: f465aceff1.exe.5.dr	Static PE information: real checksum: 0x1b432d should be: 0x1bdddb
Source: random[2].exe1.5.dr	Static PE information: real checksum: 0x1aced2 should be: 0x1afdc1
Source: file.exe	Static PE information: real checksum: 0x2e902b should be: 0x2f04cf
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2e902b should be: 0x2f04cf
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: random[2].exe.5.dr	Static PE information: real checksum: 0x1b432d should be: 0x1bdddb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: qokzkhtc
Source: file.exe	Static PE information: section name: cvovnsld
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: qokzkhtc
Source: skotes.exe.0.dr	Static PE information: section name: cvovnsld
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: uzxdwyvi
Source: random[1].exe.5.dr	Static PE information: section name: efzdldig
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: 65996c3e29.exe.5.dr	Static PE information: section name:
Source: 65996c3e29.exe.5.dr	Static PE information: section name: .idata
Source: 65996c3e29.exe.5.dr	Static PE information: section name:
Source: 65996c3e29.exe.5.dr	Static PE information: section name: uzxdwyvi
Source: 65996c3e29.exe.5.dr	Static PE information: section name: efzdldig
Source: 65996c3e29.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: mepijjqp
Source: random[2].exe.5.dr	Static PE information: section name: sxjadjho
Source: random[2].exe.5.dr	Static PE information: section name: .taggant
Source: f465aceff1.exe.5.dr	Static PE information: section name:
Source: f465aceff1.exe.5.dr	Static PE information: section name: .idata
Source: f465aceff1.exe.5.dr	Static PE information: section name:
Source: f465aceff1.exe.5.dr	Static PE information: section name: mepijjqp
Source: f465aceff1.exe.5.dr	Static PE information: section name: sxjadjho
Source: f465aceff1.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name: vsiixbzb
Source: random[1].exe1.5.dr	Static PE information: section name: lhhqnhik
Source: random[1].exe1.5.dr	Static PE information: section name: .taggant
Source: 4c87a5a549.exe.5.dr	Static PE information: section name:
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: .idata
Source: 4c87a5a549.exe.5.dr	Static PE information: section name:
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: mjanwrqb
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: poqismoi
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: .taggant
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name:
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name: .idata
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name: wokzrztg
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name: eojqxzlp
Source: 32e4f1cc69.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: .idata
Source: random[2].exe1.5.dr	Static PE information: section name:
Source: random[2].exe1.5.dr	Static PE information: section name: mlmzcfis
Source: random[2].exe1.5.dr	Static PE information: section name: bcfyzdjq
Source: random[2].exe1.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0053D91C push ecx; ret	0_2_0053D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00531359 push es; ret	0_2_0053135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008AD91C push ecx; ret	1_2_008AD92F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9B2D0 push ebp; iretd	8_2_09F9B2DE
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9AD28 push esp; iretd	8_2_09F9AD36
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9ACE9 push ebp; iretd	8_2_09F9ACF6
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9AC90 push esp; iretd	8_2_09F9AC9E
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F9AC58 push esp; iretd	8_2_09F9AC66
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F937BE push 69C84589h; ret	8_2_09F937C3
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_09F97613 push ebx; retf	8_2_09F9762A
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 8_2_0B4B03F4 push es; retf	8_2_0B4B03F7
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_01805946 push ss; retf	10_2_0180594F
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Code function: 10_2_0596735A push FFFFFFBDh; ret	10_2_0596735C
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0076A334 push ecx; retf 0078h	11_3_0076A335
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00767F08 push esp; iretd	11_3_00767F09
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_00772BAF push eax; ret	11_3_00772BB0
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C268 push 680078C2h; retn 0078h	11_3_0078C26D
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C268 push 680078C2h; retn 0078h	11_3_0078C26D
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C368 push 680078C3h; ret	11_3_0078C36D
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C368 push 680078C3h; ret	11_3_0078C36D
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C260 pushad ; retn 0078h	11_3_0078C261
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C260 pushad ; retn 0078h	11_3_0078C261
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C360 pushad ; ret	11_3_0078C361
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C360 pushad ; ret	11_3_0078C361
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C264 pushad ; retn 0078h	11_3_0078C265
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C264 pushad ; retn 0078h	11_3_0078C265
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C364 pushad ; ret	11_3_0078C365
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C364 pushad ; ret	11_3_0078C365
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C250 push eax; retn 0078h	11_3_0078C251
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C250 push eax; retn 0078h	11_3_0078C251
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Code function: 11_3_0078C350 push eax; ret	11_3_0078C351

Source: file.exe	Static PE information: section name: entropy: 7.978692736276461
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.978692736276461
Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: random[1].exe.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: 65996c3e29.exe.5.dr	Static PE information: section name: entropy: 7.974324170155358
Source: 65996c3e29.exe.5.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: random[1].exe0.5.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: 2fdda55cb5.exe.5.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: random[2].exe.5.dr	Static PE information: section name: entropy: 7.777763439891044
Source: random[2].exe.5.dr	Static PE information: section name: mepijjqp entropy: 7.953725489111988
Source: f465aceff1.exe.5.dr	Static PE information: section name: entropy: 7.777763439891044
Source: f465aceff1.exe.5.dr	Static PE information: section name: mepijjqp entropy: 7.953725489111988
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: entropy: 7.97861499073879
Source: 4c87a5a549.exe.5.dr	Static PE information: section name: mjanwrqb entropy: 7.954221738406787
Source: random[2].exe1.5.dr	Static PE information: section name: entropy: 7.798040211509876
Source: random[2].exe1.5.dr	Static PE information: section name: mlmzcfis entropy: 7.953693917571164

Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, KkPfaNtwV41t8IJvdeT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kRgN7rZEXo', 'vY6NRxgqje', 'hVKNa58P3j', 'WYyNfUrVEq', 'SFaNi701yW', 'GVuNjdS8FL', 'YtvNxEUUaW'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, HnGPflfHNmJS7oVQ3y.cs	High entropy of concatenated method names: 'hP2nCdqmoq', 'AFKnRYJuLn', 'vsvnfo3GEi', 'hU3ni5dvpu', 'DRenqf2XL4', 'Y5ynKFF4BA', 'RdxnBKejmw', 'sxNnHKSbbE', 'CbHnefHxtx', 'ddZndaDYFi'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, E1VgkvzlaUUe5I7EnV.cs	High entropy of concatenated method names: 'kOQNT5lSYk', 'q09NyiAnZC', 'LgUNZ5WmSL', 'uFrNl76ihC', 'XDRNqrdYF2', 'lfsNBD8U6k', 'kSYNHOVUmD', 'dojNsoZemT', 'tWBNFF8GPD', 'RslNPWkaNU'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, uM81CQkLcVsJBunMLq.cs	High entropy of concatenated method names: 'LMPY5jZ8hA', 'gcCYJI93VE', 'xbn4wfV97A', 'djP4tN06E0', 'IgcY7S244G', 'Y6eYRwfm2o', 'PrrYaMWSvp', 'elkYfOB0ZN', 'VoKYiMCXRu', 'KpYYjRnruC'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, aDjnAZduavW1X70xIc.cs	High entropy of concatenated method names: 'rt8DAVlUr3', 'KCXD8sT3MC', 'In1DEaCdh3', 'T3uEJsyYke', 'KqPEzrhh1A', 'YsXDwj22je', 'MWjDtWZMs8', 'dXWDgpMaMm', 'UUMDLL3Uab', 'XShD6Z6tc4'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, YSmDmSUIb6XTKqNKfJ.cs	High entropy of concatenated method names: 'eAKpMUC3Dn', 'rRrpIare1b', 'JIq8K9FCWB', 'CyY8BJBc3q', 'hW58HjWXal', 'mAt8eJ6Q9u', 'v688d1ILtU', 'XJ18WU0iCu', 'RQk8cqGFIY', 'oQS8CckGLx'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, N1MYrP94QEPot2L65P.cs	High entropy of concatenated method names: 'oUHhnlvJme', 'VHnhYRnCE2', 'rqJhhjNc8O', 'NDYhX6GqIQ', 'flnhrnehMC', 'UIthsUEdpJ', 'Dispose', 'dPL4AX55gM', 'aEn4vHEpAQ', 'NBy48RsVQY'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, dExnHFt6wLa0mOWwdBQ.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y2Vmh1YYBv', 'XuJmNdHu6B', 'x7EmXniD2o', 'rO6mm5DtYy', 'PjdmrI8LJ0', 's4jmbKycDG', 'C1Smse59bZ'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, lMspwXGJ7GGwaQ4tEX.cs	High entropy of concatenated method names: 'hEwhlvhlY7', 'LhwhqkLv6s', 'VQ0hKEDqrh', 'n5vhB8pYCi', 'weFhHIwS1n', 'I5Ihexv6TT', 'FXqhdyk1pe', 'YbrhW7uLoL', 'DLihcEJdpt', 'uoohCWvE1H'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, FAZsSmq64bjJSy6XNC.cs	High entropy of concatenated method names: 'WEqQ140LGF429pjfGJL', 'u0maot0irw6EgIuSEUu', 'CpSE4Kq6cT', 'PpiEh87CDX', 'wdfENK7Y9k', 'Vhsfw10oUOpyocbL3Bw', 'CqjWLX0AasagovgkldZ'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, XYnGdNJEdTTKvHfm3Z.cs	High entropy of concatenated method names: 'cIDN8ubs5q', 'TvgNpHbQ67', 'auPNEc6luH', 'GZ1NDkWugj', 'BSwNhCtxhQ', 'tnLNuP5cm2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, QJMEIAttci1YmKS0t4s.cs	High entropy of concatenated method names: 'TpENJD1rKN', 'A52NzPQ45b', 'bRFXwPElQq', 'wskXt6ypuu', 'jT7XgaLPis', 'xJ4XLdvGAs', 'fejX6u0XOS', 'fwLXSCJKYT', 'qV1XA2rWUW', 'ttPXvsiCNj'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, ziQ2hkapDy9nXIwQWr.cs	High entropy of concatenated method names: 'yrYQyD8mXe', 'u6cQZfZum3', 'c4BQluo8FH', 'iU3QqrFVNW', 'awWQBPWn33', 'ExNQHac1Cg', 'rYbQdpeaYR', 'bPPQWq4bFP', 's5xQC8nnU8', 'a9xQ7cEMjk'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, Kt4aMclhtREMnIB4nh.cs	High entropy of concatenated method names: 'qakESekDkA', 'KqqEv94CA8', 'drbEp7Qki4', 'xbtEDFuolZ', 'CT7EuwaYmu', 'nKBp1vaD3N', 'G72pkVrwx8', 'q9hp9ujB6g', 'Mepp5pmTh8', 'PuTpGdxE9Z'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, bFtFusgXEbLd1sfmBX.cs	High entropy of concatenated method names: 'ndVVShDRw', 'qZZ3KKtaL', 'X2QTBlOWm', 'mLXIUYGhO', 'DIUZ3NY9w', 'a5qUxEEo3', 'xA8bHnM9tf6yJpsC4C', 'tnDoQBjoojnCstZQXc', 'P5v4TSTyh', 'ukxNn3BDT'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, yUAvZA6YV6jmTkDsfi.cs	High entropy of concatenated method names: 'XMBtDHOLEv', 'mT7tuQhOrs', 'fKUt22UXfL', 'Nq7t0RJSmD', 'GNKtnfJdt4', 'QMctohtREM', 'kS6pFvEahQcm3P4igY', 'ziDQRLteB2I1tQnnIQ', 'OXBttpKc30', 'kajtLZMhQB'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, kW9HmCxyetpQAMuVTh.cs	High entropy of concatenated method names: 'B4EY2HTA96', 'tjLY0cL2oW', 'ToString', 'SL4YAxcWwJ', 'm4LYvqbAov', 'da0Y86o3co', 'eBoYpaPGfO', 'u9OYExBCLU', 'XLZYDfA5Zv', 'FNWYuiAGP9'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, h4sA0M8cttu3AytW4c.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'wZugGmaL8i', 'ha8gJA1RWm', 'V4MgzaOvO1', 'BP2LwNctoJ', 'b2OLt8fklN', 'v8KLgnAYIR', 'CoaLL4pSjq', 'rhkvKsOqB4AoFwpNVuE'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, jlRAYdtgdxajSA6E8R8.cs	High entropy of concatenated method names: 'ToString', 'HJOXyatoQc', 'HbrXZN39uU', 'f9lXUD04Q0', 'h0EXlLpsnC', 'U0VXq7VWZ8', 'vA0XKVxR97', 'RmwXBo7iEF', 'X9cjWC4ERJXLKpchTEI', 'b6s36i4tdB4eINPNVuv'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, Vg8SFAZKU2UXfLCq7R.cs	High entropy of concatenated method names: 'FaF83g5fqh', 'HCh8TdkOGl', 'h218yq9Hx1', 'qSf8ZYs5Rj', 'y5O8nk5Gab', 'OEJ8omaiWo', 'kuI8Yne6ML', 'rxE84qPFgo', 'iWa8hOoeHR', 'W1Z8NMIFqu'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, mktlYdcWP30buDWU1j.cs	High entropy of concatenated method names: 'i4cDFNeWDj', 'q18DPfh7OM', 'RSLDVMSq0l', 'sEHD391MZV', 'tp6DMMHeJx', 'KHjDTXaYZu', 'fOdDIiHR4P', 'Y1kDyV7ttr', 'LmCDZKJOGy', 'V9SDUikGuS'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, kVdiZvv5P10CtuHo1D.cs	High entropy of concatenated method names: 'Dispose', 'iPotGt2L65', 'J8ngqOtylN', 'zH0DLI3w8a', 'yDrtJBfP4Q', 'Khhtz4QRe4', 'ProcessDialogKey', 'krOgwMspwX', 'Y7GgtGwaQ4', 'bEXggGYnGd'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, p70yJbu5bF4vKhUO1a.cs	High entropy of concatenated method names: 'XR7LSXCnhI', 'k5LLApS7HO', 'D54LvXvPbY', 'CDZL82WCng', 'LaNLpus8uU', 'q5rLEyYh8n', 'TXULDqLrnl', 'RF5LukqDTl', 'iifLOaksHF', 'EbrL2A4nir'
Source: 8.2.2fdda55cb5.exe.ec50000.4.raw.unpack, IHOLEvy0T7QhOrsMmC.cs	High entropy of concatenated method names: 'U3nvfX1V1H', 'HmYviIvu6Q', 'AKRvjubO1u', 'F8evxEdJFk', 'JDJv11Bqvn', 'PmKvkNJ071', 'KlGv9VILIB', 'L67v5pysNH', 'vlRvGOFpyb', 'etWvJdsqte'

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32e4f1cc69.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e8d32508c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4c87a5a549.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f465aceff1.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4c87a5a549.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4c87a5a549.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32e4f1cc69.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 32e4f1cc69.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e8d32508c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4e8d32508c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f465aceff1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f465aceff1.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 2fdda55cb5.exe PID: 7352, type: MEMORYSTR

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_1-9708

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLCUCKOOMON.DLL
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-KQ

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F252 second address: 58EB72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FA86D24981Eh 0x00000010 jns 00007FA86D249818h 0x00000016 nop 0x00000017 add dword ptr [ebp+122D36BBh], edi 0x0000001d push dword ptr [ebp+122D0D41h] 0x00000023 jc 00007FA86D249824h 0x00000029 jmp 00007FA86D24981Eh 0x0000002e call dword ptr [ebp+122D323Fh] 0x00000034 pushad 0x00000035 xor dword ptr [ebp+122D34E9h], eax 0x0000003b xor eax, eax 0x0000003d ja 00007FA86D249828h 0x00000043 jmp 00007FA86D249822h 0x00000048 mov edx, dword ptr [esp+28h] 0x0000004c mov dword ptr [ebp+122D34E9h], ecx 0x00000052 mov dword ptr [ebp+122D2A64h], eax 0x00000058 sub dword ptr [ebp+122D37DBh], edx 0x0000005e mov esi, 0000003Ch 0x00000063 or dword ptr [ebp+122D34E9h], ecx 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D37DBh], eax 0x00000073 lodsw 0x00000075 jns 00007FA86D249820h 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f jns 00007FA86D24982Dh 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 stc 0x0000008a mov dword ptr [ebp+122D34E9h], edi 0x00000090 nop 0x00000091 pushad 0x00000092 jno 00007FA86D24981Ch 0x00000098 push ebx 0x00000099 jng 00007FA86D249816h 0x0000009f pop ebx 0x000000a0 popad 0x000000a1 push eax 0x000000a2 push esi 0x000000a3 pushad 0x000000a4 push ecx 0x000000a5 pop ecx 0x000000a6 push eax 0x000000a7 push edx 0x000000a8 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7113A3 second address: 7113BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA86D64A9A2h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7113BF second address: 7113EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D24981Fh 0x00000009 ja 00007FA86D249816h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FA86D24981Dh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703C39 second address: 703C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703C3D second address: 703C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA86D249816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007FA86D249816h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710431 second address: 710437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71094C second address: 710956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA86D249816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710956 second address: 710976 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA86D64A99Ch 0x0000000d jg 00007FA86D64A99Ch 0x00000013 jl 00007FA86D64A996h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713471 second address: 713477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713477 second address: 71347B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7135AC second address: 7135B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7136A4 second address: 7136C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jl 00007FA86D64A9A2h 0x00000011 jl 00007FA86D64A99Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7136C9 second address: 713785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp+04h], eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FA86D249821h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 or ecx, dword ptr [ebp+122D2610h] 0x0000001a push 00000003h 0x0000001c mov dword ptr [ebp+122D22EEh], ecx 0x00000022 push 00000000h 0x00000024 mov ecx, dword ptr [ebp+122D2B10h] 0x0000002a push 00000003h 0x0000002c or dword ptr [ebp+122D35ADh], edx 0x00000032 call 00007FA86D249819h 0x00000037 jmp 00007FA86D24981Eh 0x0000003c push eax 0x0000003d push edi 0x0000003e jmp 00007FA86D249828h 0x00000043 pop edi 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 pushad 0x00000049 push eax 0x0000004a jmp 00007FA86D249828h 0x0000004f pop eax 0x00000050 jmp 00007FA86D249822h 0x00000055 popad 0x00000056 mov eax, dword ptr [eax] 0x00000058 push ebx 0x00000059 jmp 00007FA86D24981Dh 0x0000005e pop ebx 0x0000005f mov dword ptr [esp+04h], eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713785 second address: 713789 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713789 second address: 713792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71385A second address: 71387D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D2170h], edx 0x00000011 push 00000000h 0x00000013 mov edx, dword ptr [ebp+122D24C9h] 0x00000019 push 29FFF213h 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71387D second address: 713881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BF23 second address: 70BF96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FA86D64A9A1h 0x00000008 pop edi 0x00000009 pushad 0x0000000a jmp 00007FA86D64A99Fh 0x0000000f jbe 00007FA86D64A996h 0x00000015 jmp 00007FA86D64A99Eh 0x0000001a je 00007FA86D64A996h 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jnl 00007FA86D64A9A2h 0x0000002b jng 00007FA86D64A9B1h 0x00000031 jmp 00007FA86D64A9A5h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BF96 second address: 70BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BF9A second address: 70BFB4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 jmp 00007FA86D64A99Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7323BC second address: 7323EF instructions: 0x00000000 rdtsc 0x00000002 je 00007FA86D249816h 0x00000008 jmp 00007FA86D249827h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FA86D24981Dh 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732876 second address: 732882 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007FA86D64A996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732882 second address: 73288A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73288A second address: 7328A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA86D64A9A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7328A5 second address: 7328A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732B82 second address: 732B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732B88 second address: 732B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732F82 second address: 732FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA86D64A996h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FA86D64A9A4h 0x00000016 jmp 00007FA86D64A99Dh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732FB5 second address: 73301C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FA86D249816h 0x00000009 jmp 00007FA86D24981Fh 0x0000000e jmp 00007FA86D249827h 0x00000013 jmp 00007FA86D249829h 0x00000018 popad 0x00000019 pushad 0x0000001a jmp 00007FA86D249829h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708A95 second address: 708AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7336C3 second address: 7336DA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA86D24981Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7336DA second address: 73371C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA86D64A9A2h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FA86D64A9A2h 0x00000017 jmp 00007FA86D64A99Ch 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jno 00007FA86D64A996h 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 733D0D second address: 733D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734173 second address: 73419B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA86D64A9A3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736969 second address: 73697E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jo 00007FA86D24981Eh 0x0000000d push eax 0x0000000e pop eax 0x0000000f jne 00007FA86D249816h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73697E second address: 736985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736985 second address: 7369A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA86D249827h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BEC9 second address: 73BECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740B81 second address: 740B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740B85 second address: 740BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FA86D64A998h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740BA1 second address: 740BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FFD8 second address: 73FFDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FFDE second address: 740000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FA86D24981Eh 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 jo 00007FA86D24981Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740179 second address: 740192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA86D64A9A4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740192 second address: 7401A5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740325 second address: 740335 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA86D64A996h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740335 second address: 74033F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74033F second address: 740349 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA86D64A9ABh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74076F second address: 74078B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA86D249816h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FA86D249820h 0x00000012 jmp 00007FA86D24981Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7408EA second address: 7408F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741262 second address: 741266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741329 second address: 741351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FA86D64A99Fh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007FA86D64A996h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741351 second address: 741355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741355 second address: 741369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnc 00007FA86D64A99Eh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741369 second address: 74137E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 clc 0x00000007 push 6464D5D3h 0x0000000c js 00007FA86D24981Eh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741666 second address: 74166A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74166A second address: 74168A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007FA86D249821h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74168A second address: 74168E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741A71 second address: 741A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742065 second address: 74206B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74206B second address: 74206F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74206F second address: 74207D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742211 second address: 742215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742310 second address: 742314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7423C2 second address: 7423C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74280A second address: 74280E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74280E second address: 742814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742814 second address: 7428A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA86D64A99Ah 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FA86D64A998h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a pushad 0x0000002b mov dword ptr [ebp+122D323Ah], edi 0x00000031 jmp 00007FA86D64A9A9h 0x00000036 popad 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007FA86D64A998h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 cld 0x00000054 push 00000000h 0x00000056 mov dword ptr [ebp+122D28C9h], eax 0x0000005c xchg eax, ebx 0x0000005d jo 00007FA86D64A9A4h 0x00000063 push eax 0x00000064 push edx 0x00000065 push ebx 0x00000066 pop ebx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7428A6 second address: 7428AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7431DC second address: 7431EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7431EA second address: 7431EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7431EE second address: 743227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 js 00007FA86D64A99Ch 0x0000000e or dword ptr [ebp+122D2DEDh], ecx 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D356Ch], ebx 0x0000001c push 00000000h 0x0000001e mov di, 9916h 0x00000022 xchg eax, ebx 0x00000023 jmp 00007FA86D64A99Fh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743227 second address: 74322B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74322B second address: 74323B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7442B6 second address: 7442C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743B84 second address: 743B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7442C8 second address: 7442CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7442CE second address: 744316 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA86D64A996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007FA86D64A99Bh 0x00000013 pop esi 0x00000014 nop 0x00000015 push 00000000h 0x00000017 jl 00007FA86D64A996h 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+122D22EEh], edi 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007FA86D64A9A6h 0x0000002e push edi 0x0000002f pop edi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744316 second address: 74431C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74431C second address: 744320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744E47 second address: 744E7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA86D249822h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA86D249823h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748459 second address: 7484FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA86D64A9A9h 0x0000000f jmp 00007FA86D64A9A3h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FA86D64A998h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007FA86D64A998h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c or edi, 22DEF820h 0x00000052 push 00000000h 0x00000054 add esi, dword ptr [ebp+122D2C00h] 0x0000005a xchg eax, ebx 0x0000005b jmp 00007FA86D64A9A2h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FA86D64A99Fh 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748FCA second address: 748FE1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA86D24981Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AE7A second address: 74AE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746BF9 second address: 746BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AE80 second address: 74AE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AE85 second address: 74AE8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA86D249816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74AE8F second address: 74AEA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FA86D64A99Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCFFC second address: 6FD002 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD002 second address: 6FD00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD00E second address: 6FD012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD012 second address: 6FD025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA86D64A996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75012D second address: 750132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7511B5 second address: 7511BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7503FB second address: 75040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA86D249816h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FA86D249816h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75329B second address: 7532A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7541F0 second address: 75420B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FA86D249818h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7533A7 second address: 7533AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7533AB second address: 7533B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7534BF second address: 7534C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7534C3 second address: 7534E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA86D249825h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 755287 second address: 755292 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA86D64A996h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7534E2 second address: 7534E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75834F second address: 758353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758353 second address: 7583CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a mov ebx, 349ED395h 0x0000000f add dword ptr [ebp+12468220h], ebx 0x00000015 popad 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007FA86D249818h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FA86D249818h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e and edi, 263391A1h 0x00000054 push eax 0x00000055 pushad 0x00000056 jnc 00007FA86D24981Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7573BD second address: 7573C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7583CC second address: 7583D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7573C3 second address: 7573C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7574C9 second address: 7574D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7574D4 second address: 7574D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7592C9 second address: 759309 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007FA86D249826h 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1F38h], esi 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D2597h], ecx 0x00000020 push 00000000h 0x00000022 xor dword ptr [ebp+122D3571h], ecx 0x00000028 mov edi, esi 0x0000002a push eax 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A1C6 second address: 75A263 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnl 00007FA86D64A9A4h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA86D64A998h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D2DC9h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FA86D64A998h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov bl, 76h 0x0000004e pushad 0x0000004f call 00007FA86D64A99Bh 0x00000054 or dword ptr [ebp+122D3566h], edx 0x0000005a pop ebx 0x0000005b popad 0x0000005c push 00000000h 0x0000005e sub dword ptr [ebp+122D3691h], eax 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FA86D64A9A7h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A263 second address: 75A269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A269 second address: 75A273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FA86D64A996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B15A second address: 75B182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA86D24981Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B182 second address: 75B187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7594CD second address: 7594D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7594D3 second address: 7594DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E068 second address: 75E06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C124 second address: 75C128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7056C4 second address: 7056C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7056C8 second address: 7056D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C128 second address: 75C132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA86D249816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7056D9 second address: 7056FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA86D64A9A2h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FA86D64A99Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7056FC second address: 705708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA86D249818h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C132 second address: 75C1AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push edi 0x0000000a call 00007FA86D64A99Fh 0x0000000f xor dword ptr [ebp+122D24EEh], edi 0x00000015 pop ebx 0x00000016 pop edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FA86D64A998h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov di, 8617h 0x00000043 mov eax, dword ptr [ebp+122D0011h] 0x00000049 mov bl, 47h 0x0000004b mov ebx, dword ptr [ebp+122D3410h] 0x00000051 push FFFFFFFFh 0x00000053 adc bx, F7D5h 0x00000058 nop 0x00000059 push eax 0x0000005a push ebx 0x0000005b push eax 0x0000005c pop eax 0x0000005d pop ebx 0x0000005e pop eax 0x0000005f push eax 0x00000060 jnc 00007FA86D64A9A4h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C1AD second address: 75C1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F6EE second address: 75F737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D359Ch], esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FA86D64A998h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c pushad 0x0000002d mov dword ptr [ebp+122D2DDBh], ebx 0x00000033 popad 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 push ebx 0x00000038 je 00007FA86D64A996h 0x0000003e pop ebx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F737 second address: 75F75A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E982 second address: 75E9A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA86D64A9A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7606F7 second address: 76074F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FA86D249818h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 movzx ebx, di 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a mov dword ptr [ebp+122D2597h], ebx 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+1246B280h], edi 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b pushad 0x0000003c pushad 0x0000003d popad 0x0000003e push ecx 0x0000003f pop ecx 0x00000040 popad 0x00000041 pop eax 0x00000042 push eax 0x00000043 pushad 0x00000044 jl 00007FA86D249818h 0x0000004a pushad 0x0000004b popad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76074F second address: 760753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7608E6 second address: 76096B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007FA86D24981Dh 0x00000011 push dword ptr fs:[00000000h] 0x00000018 add edi, 1AB8A7EDh 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push edi 0x00000026 or dword ptr [ebp+122D3575h], ecx 0x0000002c pop ebx 0x0000002d mov eax, dword ptr [ebp+122D074Dh] 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007FA86D249818h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d or di, 90F9h 0x00000052 push FFFFFFFFh 0x00000054 nop 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FA86D249821h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76096B second address: 760986 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA86D64A998h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FA86D64A99Ah 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768165 second address: 76816B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768490 second address: 7684B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007FA86D64A996h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007FA86D64A99Ch 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jne 00007FA86D64A996h 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7684B9 second address: 7684C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA86D249816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7684C5 second address: 7684C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771ED9 second address: 771EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771EDF second address: 771EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771EE4 second address: 771EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772479 second address: 7724AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D64A9A8h 0x00000009 jno 00007FA86D64A996h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FA86D64A99Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7724AE second address: 7724B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77275C second address: 772788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA86D64A9A1h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FA86D64A996h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772788 second address: 77278E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77278E second address: 772798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA86D64A996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772798 second address: 7727B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249828h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B6D3 second address: 74B701 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA86D64A99Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FA86D64A9A8h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B810 second address: 74B814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BA6E second address: 74BA7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BA7E second address: 58EB72 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1D3Fh], esi 0x00000012 push dword ptr [ebp+122D0D41h] 0x00000018 mov dword ptr [ebp+122D1DEAh], edi 0x0000001e call dword ptr [ebp+122D323Fh] 0x00000024 pushad 0x00000025 xor dword ptr [ebp+122D34E9h], eax 0x0000002b xor eax, eax 0x0000002d ja 00007FA86D249828h 0x00000033 jmp 00007FA86D249822h 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c mov dword ptr [ebp+122D34E9h], ecx 0x00000042 mov dword ptr [ebp+122D2A64h], eax 0x00000048 sub dword ptr [ebp+122D37DBh], edx 0x0000004e mov esi, 0000003Ch 0x00000053 or dword ptr [ebp+122D34E9h], ecx 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d mov dword ptr [ebp+122D37DBh], eax 0x00000063 lodsw 0x00000065 jns 00007FA86D249820h 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f jns 00007FA86D24982Dh 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 stc 0x0000007a mov dword ptr [ebp+122D34E9h], edi 0x00000080 nop 0x00000081 pushad 0x00000082 jno 00007FA86D24981Ch 0x00000088 push ebx 0x00000089 jng 00007FA86D249816h 0x0000008f pop ebx 0x00000090 popad 0x00000091 push eax 0x00000092 push esi 0x00000093 pushad 0x00000094 push ecx 0x00000095 pop ecx 0x00000096 push eax 0x00000097 push edx 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB39 second address: 74BB43 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA86D64A996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB43 second address: 74BB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB49 second address: 74BB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB4D second address: 74BB5B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BB5B second address: 74BB75 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA86D64A996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FA86D64A99Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BC43 second address: 74BC48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BC48 second address: 74BC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA86D64A9A8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BC6C second address: 74BC91 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jns 00007FA86D249816h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FA86D24981Eh 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BC91 second address: 74BCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D64A99Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BCA2 second address: 74BCD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FA86D249824h 0x00000015 jmp 00007FA86D24981Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BCD3 second address: 74BCE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D64A99Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BCE5 second address: 74BD0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov edx, edi 0x0000000b call 00007FA86D249819h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA86D249824h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BD0F second address: 74BD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BD16 second address: 74BD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FA86D24981Bh 0x0000000e jne 00007FA86D249829h 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007FA86D24981Fh 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA86D24981Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BD68 second address: 74BD6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BD6E second address: 74BD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF64 second address: 74BF72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF72 second address: 74BF7C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA86D24981Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF7C second address: 74BF8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF8B second address: 74BF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF8F second address: 74BF93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF93 second address: 74BF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BF9D second address: 74BFD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c ja 00007FA86D64A9A0h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BFD3 second address: 74BFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C1B7 second address: 74C1BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C6EC second address: 74C70F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FA86D24981Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C70F second address: 74C715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C715 second address: 74C719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C8A3 second address: 74C8A8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C8A8 second address: 74C8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a jmp 00007FA86D249820h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C8CC second address: 74C8E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA86D64A9A1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778D12 second address: 778D1C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA86D249816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778EBA second address: 778EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778EC0 second address: 778EDC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA86D249816h 0x00000008 jo 00007FA86D249816h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jnl 00007FA86D249816h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778EDC second address: 778EE6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA86D64A996h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779196 second address: 77919A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77919A second address: 77919E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779591 second address: 7795A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA86D249816h 0x0000000a jmp 00007FA86D24981Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7795A7 second address: 7795AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 779706 second address: 77970C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780D1D second address: 780D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780D21 second address: 780D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D249828h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA86D24981Eh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FA86D249816h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780D5A second address: 780D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780D5E second address: 780D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780D64 second address: 780D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FA86D64A99Bh 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780EDB second address: 780F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA86D249829h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FA86D249816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 780F03 second address: 780F07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78120D second address: 781228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249827h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813A9 second address: 7813AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7813AF second address: 7813BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FA86D249816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781936 second address: 78193A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78193A second address: 781953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D24981Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781953 second address: 781957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781957 second address: 78195B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78195B second address: 781965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781965 second address: 781984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA86D24981Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AC8 second address: 781AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007FA86D64A9A0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AE1 second address: 781AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AE5 second address: 781AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FA86D64A99Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78219E second address: 7821AF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787A1A second address: 787A28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786853 second address: 786859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786859 second address: 786865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786865 second address: 786873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D24981Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786873 second address: 786879 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786B2B second address: 786B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FA86D24981Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786F66 second address: 786F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D64A9A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787339 second address: 787343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FA86D249816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70075F second address: 70076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FA86D64A996h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70076F second address: 700791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA86D249818h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79120F second address: 791213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791213 second address: 79121F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790BDE second address: 790C06 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA86D64A998h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA86D64A9A6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790C06 second address: 790C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790C0A second address: 790C2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A8h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790C2D second address: 790C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790C32 second address: 790C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790D9C second address: 790DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007FA86D24981Ah 0x0000000c jmp 00007FA86D249826h 0x00000011 ja 00007FA86D249816h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 790DCB second address: 790DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 797A39 second address: 797A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796316 second address: 796326 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA86D64A996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796326 second address: 796336 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a js 00007FA86D249816h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796336 second address: 79635B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA86D64A9A5h 0x0000000f jno 00007FA86D64A996h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7964B3 second address: 7964F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FA86D249829h 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jmp 00007FA86D249828h 0x00000016 jno 00007FA86D249816h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7964F8 second address: 796509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FA86D64A99Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796509 second address: 79651F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249820h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7967C5 second address: 7967DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Fh 0x00000007 jc 00007FA86D64A996h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796903 second address: 796912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796912 second address: 796931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA86D64A99Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jg 00007FA86D64A996h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796931 second address: 796935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796935 second address: 79693B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796C00 second address: 796C0A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA86D249816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B555 second address: 79B559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B559 second address: 79B567 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA86D249816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79B567 second address: 79B56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79F23E second address: 79F253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA86D24981Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E745 second address: 79E754 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA86D64A99Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EE6F second address: 79EE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A52EA second address: 7A52F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A52F6 second address: 7A5300 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA86D249816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5987 second address: 7A598D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A598D second address: 7A599E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jc 00007FA86D249816h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A599E second address: 7A59A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A59A8 second address: 7A59AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A59AE second address: 7A59B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F8C second address: 7A5F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA86D249816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F98 second address: 7A5F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F9E second address: 7A5FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FA86D249826h 0x0000000b jmp 00007FA86D24981Eh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6D73 second address: 7A6D79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6D79 second address: 7A6DA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA86D249826h 0x00000008 jmp 00007FA86D249820h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA251 second address: 7AA25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA86D64A996h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA51B second address: 7AA51F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA51F second address: 7AA528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA528 second address: 7AA545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D249827h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA545 second address: 7AA54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7A8 second address: 7AA7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AA7AE second address: 7AA7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAA7E second address: 7AAAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA86D249816h 0x0000000a jmp 00007FA86D249824h 0x0000000f popad 0x00000010 jne 00007FA86D249827h 0x00000016 pushad 0x00000017 jmp 00007FA86D24981Dh 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA86D249821h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAAD7 second address: 7AAADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAADB second address: 7AAAEE instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA86D249816h 0x00000008 jl 00007FA86D249816h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAC85 second address: 7AAC8F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA86D64A996h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAC8F second address: 7AACA3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA86D24981Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jp 00007FA86D249816h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707034 second address: 70703A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70703A second address: 707040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707040 second address: 70705A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA86D64A996h 0x00000008 jbe 00007FA86D64A996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jo 00007FA86D64A99Eh 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6EFB second address: 7B6F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnp 00007FA86D249816h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6F0C second address: 7B6F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B75E0 second address: 7B75EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA86D249816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B75EC second address: 7B75FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FA86D64A99Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B78B1 second address: 7B78C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA86D249822h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B78C9 second address: 7B78E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA86D64A99Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B78E1 second address: 7B78E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B78E7 second address: 7B78EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A0E second address: 7B7A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA86D249816h 0x0000000a jmp 00007FA86D24981Ah 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FA86D24981Dh 0x00000018 popad 0x00000019 pushad 0x0000001a jc 00007FA86D249816h 0x00000020 jmp 00007FA86D24981Ch 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 jo 00007FA86D24981Eh 0x0000002e pushad 0x0000002f popad 0x00000030 jbe 00007FA86D249816h 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 jbe 00007FA86D24981Eh 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A63 second address: 7B7A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A6C second address: 7B7A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A72 second address: 7B7A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jl 00007FA86D64A996h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A7F second address: 7B7A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B7A84 second address: 7B7A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FA86D64A996h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8C06 second address: 7B8C0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B8C0C second address: 7B8C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6A5D second address: 7B6A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D24981Bh 0x00000009 popad 0x0000000a push eax 0x0000000b jp 00007FA86D249816h 0x00000011 pop eax 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007FA86D24981Ah 0x0000001b push esi 0x0000001c pop esi 0x0000001d push esi 0x0000001e pop esi 0x0000001f jmp 00007FA86D24981Eh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA1D second address: 7BEA31 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA86D64A99Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BEA31 second address: 7BEA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE43D second address: 7BE443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE443 second address: 7BE447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE447 second address: 7BE457 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA86D64A996h 0x00000008 jl 00007FA86D64A996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA705 second address: 7CA71F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FA86D24981Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA71F second address: 7CA724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D8DEA second address: 7D8DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1BF0 second address: 7E1BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1BF6 second address: 7E1C02 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA86D249816h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E349D second address: 7E34A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E34A1 second address: 7E34AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E32EB second address: 7E3309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA86D64A9A3h 0x00000009 pop edx 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3309 second address: 7E3315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA86D249816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3315 second address: 7E3320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA86D64A996h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3320 second address: 7E333C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249827h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E8DB4 second address: 7E8DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA86D64A9A9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7802 second address: 7E7821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push ebx 0x00000009 jnl 00007FA86D24981Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007FA86D249816h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7AC8 second address: 7E7B02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007FA86D64A99Bh 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jbe 00007FA86D64A996h 0x0000001a ja 00007FA86D64A996h 0x00000020 jmp 00007FA86D64A9A3h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7B02 second address: 7E7B07 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7D8C second address: 7E7D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7D90 second address: 7E7DC6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA86D249816h 0x00000008 jmp 00007FA86D249821h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA86D249827h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7DC6 second address: 7E7DE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A4h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7F32 second address: 7E7F5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249824h 0x00000007 jnl 00007FA86D249818h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007FA86D24982Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E80A0 second address: 7E80C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A7h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E80C1 second address: 7E80C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E80C5 second address: 7E810B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FA86D64A9A7h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FA86D64A9A0h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECF8A second address: 7ECFAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FA86D249816h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FA86D24981Dh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007FA86D249816h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCF0E second address: 7FCF18 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA86D64A996h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCF18 second address: 7FCF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCF1E second address: 7FCF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007FA86D64A996h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828C8F second address: 828C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828C95 second address: 828C9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828C9B second address: 828CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828CA7 second address: 828CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827C04 second address: 827C0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827C0A second address: 827C2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827C2A second address: 827C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827C2E second address: 827C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827EFC second address: 827F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827F00 second address: 827F37 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA86D64A996h 0x00000008 jp 00007FA86D64A996h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA86D64A9A4h 0x00000015 jmp 00007FA86D64A99Eh 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827F37 second address: 827F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827F42 second address: 827F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FA86D64A99Ch 0x0000000c jg 00007FA86D64A996h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 827F57 second address: 827F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8280AA second address: 8280AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8283A6 second address: 8283BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA86D24981Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82850A second address: 828510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828510 second address: 828514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828514 second address: 828522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828522 second address: 828545 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249823h 0x00000007 ja 00007FA86D249816h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828545 second address: 82855F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA86D64A996h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA86D64A99Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8289FE second address: 828A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828A06 second address: 828A0E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 828A0E second address: 828A19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007FA86D249816h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B8D2 second address: 82B8DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82EA56 second address: 82EA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D001B second address: 49D0021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0021 second address: 49D0025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0025 second address: 49D0065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA86D64A9A1h 0x00000014 adc ecx, 79D296C6h 0x0000001a jmp 00007FA86D64A9A1h 0x0000001f popfd 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0065 second address: 49D00A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 movsx ebx, ax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA86D249824h 0x00000012 adc eax, 52175A98h 0x00000018 jmp 00007FA86D24981Bh 0x0000001d popfd 0x0000001e mov ebx, esi 0x00000020 popad 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 mov bh, cl 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D00A2 second address: 49D00A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D00A6 second address: 49D0112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FA86D249829h 0x0000000b pushfd 0x0000000c jmp 00007FA86D249820h 0x00000011 sbb cx, 5F58h 0x00000016 jmp 00007FA86D24981Bh 0x0000001b popfd 0x0000001c pop esi 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 jmp 00007FA86D24981Fh 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FA86D249825h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0112 second address: 49D0122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D64A99Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0122 second address: 49D0126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E2C second address: 49B0E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E32 second address: 49B0E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E37 second address: 49B0E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA86D64A99Eh 0x00000008 pop eax 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E56 second address: 49B0E5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0E5A second address: 49B0E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000F4 second address: 4A000FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000FA second address: 4A000FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000FE second address: 4A00186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA86D249821h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA86D24981Ch 0x00000016 or ax, 89E8h 0x0000001b jmp 00007FA86D24981Bh 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007FA86D249828h 0x00000027 adc ecx, 48211C48h 0x0000002d jmp 00007FA86D24981Bh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007FA86D249826h 0x0000003b pop ebp 0x0000003c pushad 0x0000003d mov ax, 64FDh 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00186 second address: 4A0018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990118 second address: 499014F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA86D249826h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA86D24981Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499014F second address: 4990155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990155 second address: 4990159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990159 second address: 4990190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA86D64A9A2h 0x00000012 add eax, 12FFD9B8h 0x00000018 jmp 00007FA86D64A99Bh 0x0000001d popfd 0x0000001e mov ecx, 62650DEFh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990190 second address: 4990196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990196 second address: 4990201 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov di, si 0x00000011 mov dx, ax 0x00000014 popad 0x00000015 push dword ptr [ebp+04h] 0x00000018 pushad 0x00000019 mov edx, ecx 0x0000001b pushfd 0x0000001c jmp 00007FA86D64A9A4h 0x00000021 or si, F5A8h 0x00000026 jmp 00007FA86D64A99Bh 0x0000002b popfd 0x0000002c popad 0x0000002d push dword ptr [ebp+0Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FA86D64A9A0h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990201 second address: 4990205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990205 second address: 499020B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499020B second address: 499021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C00 second address: 49B0C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C06 second address: 49B0C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FA86D249822h 0x00000010 add ax, D4F8h 0x00000015 jmp 00007FA86D24981Bh 0x0000001a popfd 0x0000001b mov bx, ax 0x0000001e popad 0x0000001f mov dword ptr [esp], ebp 0x00000022 pushad 0x00000023 mov esi, 1C9B0027h 0x00000028 pushfd 0x00000029 jmp 00007FA86D24981Ch 0x0000002e add ah, 00000058h 0x00000031 jmp 00007FA86D24981Bh 0x00000036 popfd 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a pushad 0x0000003b mov edx, eax 0x0000003d pushfd 0x0000003e jmp 00007FA86D249820h 0x00000043 sbb esi, 076239B8h 0x00000049 jmp 00007FA86D24981Bh 0x0000004e popfd 0x0000004f popad 0x00000050 pop ebp 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0C8D second address: 49B0C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B077F second address: 49B07DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA86D249829h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FA86D24981Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FA86D24981Eh 0x0000001e or ecx, 76C509A8h 0x00000024 jmp 00007FA86D24981Bh 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B06A1 second address: 49B071B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FA86D64A9A0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FA86D64A99Dh 0x0000001c adc cx, D2D6h 0x00000021 jmp 00007FA86D64A9A1h 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007FA86D64A9A0h 0x0000002d xor si, 88F8h 0x00000032 jmp 00007FA86D64A99Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B071B second address: 49B0721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0721 second address: 49B0725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0725 second address: 49B0729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0413 second address: 49B0419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0419 second address: 49B041D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B041D second address: 49B042A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0141 second address: 49C0145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0145 second address: 49C014B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C014B second address: 49C016E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FA86D24981Dh 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C016E second address: 49C0189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 movsx edx, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0189 second address: 49C01CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA86D249826h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA86D249827h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01CA second address: 49C01F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, ax 0x00000010 mov si, E5ABh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01F3 second address: 49C01F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C01F9 second address: 49C01FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0003A second address: 4A00040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00040 second address: 4A00044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00044 second address: 4A00048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00048 second address: 4A00077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA86D64A9A9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dx, 599Eh 0x00000017 mov si, di 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00077 second address: 4A0007D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A0007D second address: 4A00081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A00081 second address: 4A000A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA86D24981Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000A0 second address: 4A000AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A000AF second address: 4A000C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D249824h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0488 second address: 49D04BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 mov dx, si 0x00000015 popad 0x00000016 popad 0x00000017 and dword ptr [eax+04h], 00000000h 0x0000001b pushad 0x0000001c mov ch, 9Bh 0x0000001e pushad 0x0000001f mov cx, dx 0x00000022 push edx 0x00000023 pop esi 0x00000024 popad 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FA86D64A99Ch 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0629 second address: 49B0639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E36 second address: 49C0E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E3A second address: 49C0E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0E3E second address: 49C0E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D02D6 second address: 49D02E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D02E5 second address: 49D0307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, F6h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA86D64A9A3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0307 second address: 49D0326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 jmp 00007FA86D24981Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ebx, 3A618F86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D0326 second address: 49D032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49D032B second address: 49D0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0726 second address: 49F074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FA86D64A99Ah 0x00000012 pop eax 0x00000013 mov bh, DBh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F074D second address: 49F0753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0753 second address: 49F0757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0757 second address: 49F0784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA86D249825h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0784 second address: 49F078A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F078A second address: 49F078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F078E second address: 49F079E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F079E second address: 49F07A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07A2 second address: 49F07B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07B2 second address: 49F07D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, FAC4h 0x00000007 mov ebx, 114DFF30h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA86D24981Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07D4 second address: 49F07D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07D8 second address: 49F07DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F07DE second address: 49F085C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007FA86D64A9A0h 0x00000011 mov eax, dword ptr [76FB65FCh] 0x00000016 jmp 00007FA86D64A9A0h 0x0000001b test eax, eax 0x0000001d pushad 0x0000001e movzx eax, dx 0x00000021 pushfd 0x00000022 jmp 00007FA86D64A9A3h 0x00000027 add al, 0000004Eh 0x0000002a jmp 00007FA86D64A9A9h 0x0000002f popfd 0x00000030 popad 0x00000031 je 00007FA8DFB8DAACh 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F085C second address: 49F086F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F086F second address: 49F0887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D64A9A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0887 second address: 49F088B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F088B second address: 49F08EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a jmp 00007FA86D64A9A7h 0x0000000f xor eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA86D64A9A0h 0x00000019 adc eax, 5EC97DB8h 0x0000001f jmp 00007FA86D64A99Bh 0x00000024 popfd 0x00000025 popad 0x00000026 and ecx, 1Fh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FA86D64A9A5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F08EE second address: 49F08F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F08F4 second address: 49F0904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ror eax, cl 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0904 second address: 49F0908 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0908 second address: 49F090E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F090E second address: 49F092F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov eax, edx 0x0000000f mov cx, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F092F second address: 49F094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 retn 0004h 0x00000009 nop 0x0000000a mov esi, eax 0x0000000c lea eax, dword ptr [ebp-08h] 0x0000000f xor esi, dword ptr [00582014h] 0x00000015 push eax 0x00000016 push eax 0x00000017 push eax 0x00000018 lea eax, dword ptr [ebp-10h] 0x0000001b push eax 0x0000001c call 00007FA871AFB20Eh 0x00000021 push FFFFFFFEh 0x00000023 pushad 0x00000024 movzx eax, bx 0x00000027 mov eax, edx 0x00000029 popad 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 mov eax, 3DFDC1D9h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F094D second address: 49F0953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0953 second address: 49F0957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0957 second address: 49F095B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F095B second address: 49F09A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007FA871AFB233h 0x00000010 mov edi, edi 0x00000012 jmp 00007FA86D64A99Dh 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FA86D64A99Eh 0x0000001d push eax 0x0000001e jmp 00007FA86D64A99Bh 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FA86D64A9A0h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F09A3 second address: 49F09A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F09A9 second address: 49F0A11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, A6h 0x00000005 pushfd 0x00000006 jmp 00007FA86D64A9A9h 0x0000000b or cl, FFFFFF96h 0x0000000e jmp 00007FA86D64A9A1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 jmp 00007FA86D64A99Eh 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push edx 0x00000023 pop eax 0x00000024 call 00007FA86D64A9A9h 0x00000029 pop ecx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0A11 second address: 49F0A17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49F0A17 second address: 49F0A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0030 second address: 49A0036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0036 second address: 49A003A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A003A second address: 49A0065 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d call 00007FA86D249824h 0x00000012 pop edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0065 second address: 49A0092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FA86D64A99Fh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA86D64A9A0h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0092 second address: 49A0096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0096 second address: 49A009C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A009C second address: 49A00A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00A2 second address: 49A00A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00A6 second address: 49A00AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A00AA second address: 49A0151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FA86D64A9A4h 0x0000000f and esp, FFFFFFF8h 0x00000012 pushad 0x00000013 call 00007FA86D64A99Eh 0x00000018 call 00007FA86D64A9A2h 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pushad 0x00000020 mov ebx, eax 0x00000022 mov eax, 27F429C9h 0x00000027 popad 0x00000028 popad 0x00000029 xchg eax, ecx 0x0000002a jmp 00007FA86D64A9A4h 0x0000002f push eax 0x00000030 pushad 0x00000031 mov ax, dx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FA86D64A9A3h 0x0000003b and ax, 86DEh 0x00000040 jmp 00007FA86D64A9A9h 0x00000045 popfd 0x00000046 mov edx, ecx 0x00000048 popad 0x00000049 popad 0x0000004a xchg eax, ecx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0151 second address: 49A0155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0155 second address: 49A015B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A015B second address: 49A016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A016C second address: 49A0170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0170 second address: 49A01AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop esi 0x0000000e pushfd 0x0000000f jmp 00007FA86D24981Bh 0x00000014 adc ax, 4E4Eh 0x00000019 jmp 00007FA86D249829h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A01AA second address: 49A020B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA86D64A9A7h 0x00000009 xor ecx, 1145BC5Eh 0x0000000f jmp 00007FA86D64A9A9h 0x00000014 popfd 0x00000015 mov ecx, 47062527h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA86D64A9A9h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A020B second address: 49A0269 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c jmp 00007FA86D24981Eh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 push esi 0x00000014 mov ebx, 367C5600h 0x00000019 pop edx 0x0000001a call 00007FA86D249826h 0x0000001f pop edi 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 mov cx, bx 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FA86D24981Ch 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0269 second address: 49A0278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A99Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0278 second address: 49A02C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007FA86D24981Eh 0x00000011 xchg eax, edi 0x00000012 jmp 00007FA86D249820h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov esi, 34442403h 0x00000020 mov cx, FD5Fh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A02C5 second address: 49A02D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D64A9A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A02D9 second address: 49A0354 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007FA86D249826h 0x00000011 test esi, esi 0x00000013 jmp 00007FA86D249820h 0x00000018 je 00007FA8DF7D7B18h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 call 00007FA86D24981Dh 0x00000026 pop eax 0x00000027 pushfd 0x00000028 jmp 00007FA86D249821h 0x0000002d sub cx, 96F6h 0x00000032 jmp 00007FA86D249821h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0354 second address: 49A0384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 mov bh, cl 0x00000013 mov dx, 415Ch 0x00000017 popad 0x00000018 je 00007FA8DFBD8C49h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0384 second address: 49A03A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D249828h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03A0 second address: 49A03A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03A6 second address: 49A03AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03AA second address: 49A03CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA86D64A9A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03CB second address: 49A03DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D24981Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03DD second address: 49A03ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A03ED second address: 49A041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA86D249826h 0x0000000a or ax, 4198h 0x0000000f jmp 00007FA86D24981Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A041A second address: 49A04A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA86D64A99Fh 0x00000009 or eax, 09BC925Eh 0x0000000f jmp 00007FA86D64A9A9h 0x00000014 popfd 0x00000015 mov ch, 83h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test edx, 61000000h 0x00000020 jmp 00007FA86D64A9A3h 0x00000025 jne 00007FA8DFBD8BB3h 0x0000002b jmp 00007FA86D64A9A6h 0x00000030 test byte ptr [esi+48h], 00000001h 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FA86D64A9A7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907E7 second address: 49907ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907ED second address: 49907F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907F3 second address: 49907F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49907F7 second address: 4990899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FA86D64A9A8h 0x00000010 or eax, 5F1A4238h 0x00000016 jmp 00007FA86D64A99Bh 0x0000001b popfd 0x0000001c call 00007FA86D64A9A8h 0x00000021 pushfd 0x00000022 jmp 00007FA86D64A9A2h 0x00000027 xor cl, FFFFFFC8h 0x0000002a jmp 00007FA86D64A99Bh 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 mov ebp, esp 0x00000034 jmp 00007FA86D64A99Fh 0x00000039 and esp, FFFFFFF8h 0x0000003c jmp 00007FA86D64A9A6h 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990899 second address: 499089D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499089D second address: 49908A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49908A3 second address: 49908B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov ebx, 7C2608D2h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov al, 6Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49908B7 second address: 49908E9 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 4C546B64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, E5E7h 0x00000012 pushfd 0x00000013 jmp 00007FA86D64A99Ch 0x00000018 adc esi, 77B60618h 0x0000001e jmp 00007FA86D64A99Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49908E9 second address: 4990901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D249824h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A3F second address: 4990A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA8DFBE02E5h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov esi, 3B00FFF9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A62 second address: 4990A9B instructions: 0x00000000 rdtsc 0x00000002 mov dl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test byte ptr [76FB6968h], 00000002h 0x0000000e jmp 00007FA86D24981Ch 0x00000013 jne 00007FA8DF7DF150h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FA86D249827h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990A9B second address: 4990AD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FA86D64A99Eh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov bx, E1E0h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990AD3 second address: 4990AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990AD8 second address: 4990B1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D64A9A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA86D64A99Bh 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FA86D64A9A6h 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B1A second address: 4990B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B1E second address: 4990B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B22 second address: 4990B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B28 second address: 4990B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B2E second address: 4990B49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA86D24981Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B49 second address: 4990B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B4F second address: 4990B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B55 second address: 4990B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B59 second address: 4990B7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA86D249828h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990B7C second address: 4990BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, A224h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+14h] 0x0000000f pushad 0x00000010 call 00007FA86D64A99Fh 0x00000015 pushfd 0x00000016 jmp 00007FA86D64A9A8h 0x0000001b add cx, 0008h 0x00000020 jmp 00007FA86D64A99Bh 0x00000025 popfd 0x00000026 pop ecx 0x00000027 mov bh, 46h 0x00000029 popad 0x0000002a push dword ptr [ebp+10h] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FA86D64A9A7h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990BE5 second address: 4990BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA86D249824h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4990BFD second address: 4990C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58EACB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58EB7F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58C32A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 58EAD1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 74B86B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7C39C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8FEACB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8FEB7F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8FC32A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8FEAD1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ABB86B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B339C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Special instruction interceptor: First address: 88DE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Special instruction interceptor: First address: 91F426 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Special instruction interceptor: First address: C2280D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Special instruction interceptor: First address: C02931 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Special instruction interceptor: First address: C83625 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Special instruction interceptor: First address: A2FD5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Special instruction interceptor: First address: BD123B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Special instruction interceptor: First address: 10D994 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Special instruction interceptor: First address: 2B77C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Special instruction interceptor: First address: 2B6898 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Special instruction interceptor: First address: 2B6583 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Special instruction interceptor: First address: 10D8DA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 53D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 63D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 6500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 7500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: B4C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: C4C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: C950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: D950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: ED10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: FD10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 10D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 1800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Memory allocated: 3240000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 4C50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 4F60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 4D90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Memory allocated: DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Memory allocated: 2870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Memory allocated: 27B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 4AD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 4C80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Memory allocated: 6C80000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A10D14 rdtsc

0_2_04A10D14

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 992	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 911	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1264	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 959	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1572	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1237
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1221
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 954
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1236
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1211
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1191
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1239
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1462
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1084
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1463
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1112
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1129
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Window / User API: threadDelayed 1081
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Window / User API: threadDelayed 9666
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8415
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 811
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Window / User API: threadDelayed 670
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8821

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8148	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8120	Thread sleep count: 992 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8120	Thread sleep time: -1984992s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8108	Thread sleep count: 300 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8108	Thread sleep time: -9000000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8124	Thread sleep count: 911 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8124	Thread sleep time: -1822911s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep count: 1264 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep time: -2529264s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep count: 959 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep time: -1918959s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep count: 1572 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8128	Thread sleep time: -3145572s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe TID: 5660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe TID: 7476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe TID: 7372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 332	Thread sleep count: 1237 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 332	Thread sleep time: -2475237s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5496	Thread sleep count: 1221 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5496	Thread sleep time: -2443221s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3652	Thread sleep count: 954 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3652	Thread sleep time: -1908954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3244	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5084	Thread sleep count: 1236 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5084	Thread sleep time: -2473236s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3584	Thread sleep count: 1211 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3584	Thread sleep time: -2423211s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5104	Thread sleep count: 1191 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5104	Thread sleep time: -2383191s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5500	Thread sleep count: 1201 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 5500	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 7848	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 7876	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 796	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 7904	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 7896	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7084	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7084	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7128	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7128	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 3396	Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7080	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7080	Thread sleep time: -90045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7068	Thread sleep count: 55 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7068	Thread sleep time: -110055s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7096	Thread sleep count: 56 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 7096	Thread sleep time: -112056s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6476	Thread sleep count: 1239 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6476	Thread sleep time: -2479239s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6616	Thread sleep count: 1462 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6616	Thread sleep time: -2925462s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6496	Thread sleep count: 1084 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6496	Thread sleep time: -2169084s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 4124	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6632	Thread sleep count: 1463 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6632	Thread sleep time: -2927463s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6520	Thread sleep count: 1112 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6520	Thread sleep time: -2225112s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6628	Thread sleep count: 1129 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6628	Thread sleep time: -2259129s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6552	Thread sleep count: 1081 > 30
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe TID: 6552	Thread sleep time: -2163081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe TID: 5236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 5576	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 2076	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 4236	Thread sleep count: 242 > 30
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe TID: 4236	Thread sleep time: -1452000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99733s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99620s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99390s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99280s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99169s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -99046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98935s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98825s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98715s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98593s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98482s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98353s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -98102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97771s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97643s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97514s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97379s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97215s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -97043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96916s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96796s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96673s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96552s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96403s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96269s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96149s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -96026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95907s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95787s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95666s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95545s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95423s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95303s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95182s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -95061s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94940s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94819s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94698s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94718s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94596s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94475s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94355s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94243s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94123s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -94002s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93847s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93725s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93606s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93487s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93366s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93244s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93124s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe TID: 2472	Thread sleep time: -93003s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5572	Thread sleep count: 8415 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2568	Thread sleep count: 811 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6352	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5804	Thread sleep count: 8821 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5080	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe TID: 1976	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe TID: 1432	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe TID: 5848	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe TID: 6244	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe TID: 420	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe TID: 4144	Thread sleep time: -36018s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99859
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99733
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99620
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99500
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99390
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99280
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99169
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 99046
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98935
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98825
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98715
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98593
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98482
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98353
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98217
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 98102
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97953
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97771
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97643
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97514
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97379
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97215
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 97043
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96916
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96796
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96673
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96552
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96403
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96269
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96149
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 96026
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95907
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95787
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95666
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95545
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95423
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95303
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95182
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 95061
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94940
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94819
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94698
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94718
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94596
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94475
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94355
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94243
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94123
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 94002
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93847
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93725
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93606
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93487
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93366
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93244
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93124
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Thread delayed: delay time: 93003
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: file.exe, file.exe, 00000000.00000000.1675067486.0000000000719000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, skotes.exe, 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1708233433.0000000000A89000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000000.2299825724.0000000000A89000.00000080.00000001.01000000.00000007.sdmp, 65996c3e29.exe, 65996c3e29.exe, 00000006.00000002.2487728862.000000000086F000.00000040.00000001.01000000.00000009.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3231529361.0000000000BAF000.00000040.00000001.01000000.00000013.sdmp, 4c87a5a549.exe, 0000000D.00000002.3327965053.0000000000BD8000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareMb
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLRkq
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AEXMA SAB2B3A3TM@\kq0VMware\|VIRTUAL\|A M I\|Xen
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll
Source: 65996c3e29.exe, 00000006.00000003.2487224670.00000000012DA000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488305546.00000000012DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq 1:en-CH:Microsoft\|VMWare\|Virtual
Source: 65996c3e29.exe, 00000006.00000003.2487499130.0000000001314000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487394554.000000000130A000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 4c87a5a549.exe, 0000000B.00000003.3288438246.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2653233136.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3336736640.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3213436353.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013B4000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000003.3326905136.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001E.00000002.3010231319.000002202CABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3492616015.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: guEx7sth PHuayS S4BCh9Hb@\kq0Microsoft\|VMWare\|Virtual
Source: file.exe, 00000000.00000003.1703279773.0000000000B2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\((
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\kq
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq"C:\Windows\system32\vmGuestLib.dll
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $kq"C:\Windows\system32\vmGuestLib.dll@
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual@\kq
Source: 32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWG
Source: 4c87a5a549.exe, 0000000D.00000003.3325641369.000000000150F000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001510000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWNV
Source: file.exe, 00000000.00000000.1675067486.0000000000719000.00000080.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000001.00000000.1708233433.0000000000A89000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000000.2299825724.0000000000A89000.00000080.00000001.01000000.00000007.sdmp, 65996c3e29.exe, 00000006.00000002.2487728862.000000000086F000.00000040.00000001.01000000.00000009.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3231529361.0000000000BAF000.00000040.00000001.01000000.00000013.sdmp, 4c87a5a549.exe, 0000000D.00000002.3327965053.0000000000BD8000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmGuestLib.dll@\kq
Source: 2fdda55cb5.exe, 0000000A.00000002.2590927332.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLRkq

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04A10D14 rdtsc

0_2_04A10D14

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055652B mov eax, dword ptr fs:[00000030h]	0_2_0055652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0055A302 mov eax, dword ptr fs:[00000030h]	0_2_0055A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008CA302 mov eax, dword ptr fs:[00000030h]	1_2_008CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_008C652B mov eax, dword ptr fs:[00000030h]	1_2_008C652B

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe

Memory written: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: 65996c3e29.exe	String found in binary or memory: rapeflowwj.lat
Source: 65996c3e29.exe	String found in binary or memory: crosshuaht.lat
Source: 65996c3e29.exe	String found in binary or memory: sustainskelet.lat
Source: 65996c3e29.exe	String found in binary or memory: aspecteirs.lat
Source: 65996c3e29.exe	String found in binary or memory: energyaffai.lat
Source: 65996c3e29.exe	String found in binary or memory: necklacebudi.lat
Source: 65996c3e29.exe	String found in binary or memory: discokeyus.lat
Source: 65996c3e29.exe	String found in binary or memory: grannyejh.lat
Source: 65996c3e29.exe	String found in binary or memory: treehoneyi.click
Source: 4c87a5a549.exe, 0000000B.00000003.2600740335.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe "C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe "C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe "C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe "C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe "C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe "C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe "C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe "C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Process created: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe "C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: 4e8d32508c.exe, 0000000E.00000000.2759063792.00000000004E2000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, skotes.exe, 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3235122763.0000000000BF7000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Program Manager
Source: 4c87a5a549.exe, 0000000D.00000002.3327965053.0000000000BD8000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: ?Program Manager
Source: firefox.exe, 0000001E.00000002.3001053335.00000076783FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: 65996c3e29.exe, 65996c3e29.exe, 00000006.00000002.2487728862.000000000086F000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: jLProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017754001\2e9378d7c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017754001\2e9378d7c8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017755001\bad8914ef8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017755001\bad8914ef8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017756001\9833339200.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017756001\9833339200.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017757001\e7ddef97c0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017757001\e7ddef97c0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0053CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0053CBEA

Source: C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 4c87a5a549.exe, 4c87a5a549.exe, 0000000B.00000003.3288438246.0000000000785000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3288438246.000000000077B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1720825276.0000000005040000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2312159104.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1689016313.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4e8d32508c.exe PID: 7952, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 6156, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000022.00000003.2900882871.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3295527171.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3219956673.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3306873384.00000000014EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2697039988.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 00000023.00000002.3246036517.0000000003A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3246036517.00000000038DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4c87a5a549.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":[""],"z":"Wallets/Guarda","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\DashCore\\wallets","m":[".dat"],"z":"Wallets/DashCore","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\WalletWasabi\\Client\\Wallets","m":[""],"z":"Wallets/Wasabi","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Daedalus Mainnet\\wallets","m":["she..sqlite"],"z":"Wallets/Daedalus","d":0,"fs":20971520},{"t":1,"p":"%localappdata%\\Google\\Chrome\\User Data","z":"Chrome","f":"Google Chrome","n":"chrome.exe","l":"chrome.dll"},{"t":1,"p":"%localappdata%\\Google\\Chrome Beta\\User Data","z":"Chrome Beta","f":"Google Chrome Beta","n":"ch
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 2fdda55cb5.exe, 0000000A.00000002.2597042995.00000000058B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: JA9tbD6HjaXXvXThiII
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":[""],"z":"Wallets/Guarda","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\DashCore\\wallets","m":[".dat"],"z":"Wallets/DashCore","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\WalletWasabi\\Client\\Wallets","m":[""],"z":"Wallets/Wasabi","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Daedalus Mainnet\\wallets","m":["she..sqlite"],"z":"Wallets/Daedalus","d":0,"fs":20971520},{"t":1,"p":"%localappdata%\\Google\\Chrome\\User Data","z":"Chrome","f":"Google Chrome","n":"chrome.exe","l":"chrome.dll"},{"t":1,"p":"%localappdata%\\Google\\Chrome Beta\\User Data","z":"Chrome Beta","f":"Google Chrome Beta","n":"ch
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: exodus.conf.json
Source: 4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":[""],"z":"Wallets/Guarda","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\DashCore\\wallets","m":[".dat"],"z":"Wallets/DashCore","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\WalletWasabi\\Client\\Wallets","m":[""],"z":"Wallets/Wasabi","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Daedalus Mainnet\\wallets","m":["she..sqlite"],"z":"Wallets/Daedalus","d":0,"fs":20971520},{"t":1,"p":"%localappdata%\\Google\\Chrome\\User Data","z":"Chrome","f":"Google Chrome","n":"chrome.exe","l":"chrome.dll"},{"t":1,"p":"%localappdata%\\Google\\Chrome Beta\\User Data","z":"Chrome Beta","f":"Google Chrome Beta","n":"ch
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: ElectrumLTC
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B0000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: passphrase.json
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000895000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: \Ethereum\
Source: 4c87a5a549.exe	String found in binary or memory: Wallets/Exodus
Source: 4c87a5a549.exe	String found in binary or memory: Wallets/Ethereum
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 4c87a5a549.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.00000000008B0000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000864000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2fdda55cb5.exe, 0000000A.00000002.2597042995.00000000058B0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: 4c87a5a549.exe, 0000000B.00000003.3213436353.0000000000785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\=XbR`

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN

Source: C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	Directory queried: number of queries: 2002

Source: Yara match	File source: 00000034.00000003.3520830366.0000000000A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3493290951.0000000001718000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3203898816.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000034.00000003.3515342718.0000000000A33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3212168666.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3492616015.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 6156, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4e8d32508c.exe PID: 7952, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4c87a5a549.exe PID: 6156, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000022.00000003.2900882871.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3295527171.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3219956673.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3306873384.00000000014EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2697039988.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 00000023.00000002.3246036517.0000000003A00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3246036517.00000000038DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 32e4f1cc69.exe PID: 7860, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	31 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	5 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	112 Process Injection	23 Software Packing	NTDS	1081 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	481 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	481 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	44%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe	47%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	44%	ReversingLabs	Win32.Infostealer.Tinba

Name	Malicious	Antivirus Detection	Reputation
grannyejh.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.206/	32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013CA000.00000004.00000020.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/outcomes/itemshttp://mozilla.org/#/properties/featureIds/itemshttp:/	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/apic	65996c3e29.exe, 00000006.00000003.2487499130.0000000001314000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000003.2487394554.000000000130A000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat/v	4c87a5a549.exe, 00000015.00000003.3465636895.000000000177D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001E.00000003.2942680167.00000220391D9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3041745151.0000022031687000.00000004.00000800.00020000.00000000.sdmp	false	high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001E.00000002.3029381877.0000022030B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3052763404.00000220322D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2925506213.00000220322D2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/userFacingName	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001E.00000003.2830444600.0000022030C00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/branches/anyOf/0http	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/branches/anyOf/2	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001E.00000002.3012967491.000002202D207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	2fdda55cb5.exe, 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.libertyreserve.com/beta/xml/history.aspx	2fdda55cb5.exe, 00000008.00000000.2503348529.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	false	high
https://ok.ru/	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat/))	4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	4c87a5a549.exe, 0000000B.00000003.3203789202.000000000546F000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3271060661.000000000BA02000.00000004.00000020.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000002.3245465248.0000000001428000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3440374392.000000000178B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3015486112.000002202DF63000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/csvImport	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	4c87a5a549.exe, 0000000B.00000003.2654402913.00000000054AA000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2654274174.00000000054AD000.00000004.00000800.00020000.00000000.sdmp, 32e4f1cc69.exe, 0000000C.00000003.2912671743.000000000144E000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3349805350.0000000005D09000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347064379.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3347900222.0000000005D09000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://treehoneyi.click/api	65996c3e29.exe, 00000006.00000002.2488421739.0000000001315000.00000004.00000020.00020000.00000000.sdmp, 65996c3e29.exe, 00000006.00000002.2488344508.00000000012F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bugzilla.mo	firefox.exe, 0000001E.00000002.3066061590.0000022033003000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/localizations/anyOf/1http://mozilla.org/#/properties/localizations/a	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001E.00000002.3041745151.00000220316EE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/enrollmentEndDatehttp://mozilla.org/#/properties/merinoEndpointURLre	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://spocs.getpocket.com/	firefox.exe, 0000001E.00000002.3093351980.00000220391F8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/apiME=jone	4c87a5a549.exe, 0000000B.00000003.3213066339.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3214533700.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.iqiyi.com/	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/endDate	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/apiP	4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007F5000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat/apiO	4c87a5a549.exe, 0000000B.00000003.3204876642.000000000547B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3312584068.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3285910032.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3311434181.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204394478.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3296560979.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203663419.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.founder.com.cn/cn/bThe	2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/t	4c87a5a549.exe, 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203898816.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/o	4c87a5a549.exe, 0000000B.00000003.3336288412.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://grannyejh.lat/apiU	4c87a5a549.exe, 0000000B.00000003.2679943422.000000000547D000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2679103467.000000000546E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://api.libertyreserve.com/beta/xml/history.aspxS	2fdda55cb5.exe, 00000008.00000002.2578504500.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phps	32e4f1cc69.exe, 0000000C.00000002.3245465248.00000000013E2000.00000004.00000020.00020000.00000000.sdmp	false	high
https://account.bellmedia.c	firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://login.microsoftonline.com	firefox.exe, 0000001E.00000003.2994610003.000002203458B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3075120341.00000220344C4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.zhihu.com/	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	4c87a5a549.exe, 0000000B.00000003.2703561942.00000000054A8000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3434717802.0000000005D0B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat:443/apid	4c87a5a549.exe, 0000000D.00000003.3325641369.0000000001529000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000D.00000002.3332217358.0000000001529000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/products/firefoxgro.all	4c87a5a549.exe, 00000015.00000003.3437804110.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000001E.00000003.2994610003.0000022034591000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001E.00000003.2989468446.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3011782071.000002202CF7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000003.2835190663.0000022030A1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3009546180.000002202C954000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat/0	4c87a5a549.exe, 00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001E.00000002.3041745151.0000022031652000.00000004.00000800.00020000.00000000.sdmp	false	high
https://screenshots.firefox.com/	firefox.exe, 0000001E.00000003.2831627443.0000022030E20000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/1	4c87a5a549.exe, 0000000B.00000003.2702813808.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2702548176.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204876642.000000000547B000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3312584068.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.2704627256.000000000547E000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3285910032.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3311434181.0000000005477000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3204394478.0000000005478000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3296560979.0000000005479000.00000004.00000800.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3203663419.0000000005474000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001E.00000003.2994428100.0000022038F55000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat//	4c87a5a549.exe, 0000000B.00000003.2653394884.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://necklacebudi.lat:443/api	4c87a5a549.exe, 00000015.00000003.3492616015.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3342898036.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://screenshots.firefox.com0	firefox.exe, 0000001E.00000002.3026566290.000002202F2E2000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://json-schema.org/draft-07/schema#-	firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestionshttp://mozilla.org/#/propertie	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://vk.com/	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat/2	4c87a5a549.exe, 00000015.00000003.3342898036.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3343465480.0000000001718000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://api.libertyreserve.com/beta/xml/	2fdda55cb5.exe, 00000008.00000000.2503348529.0000000000982000.00000002.00000001.01000000.0000000A.sdmp	false	high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://necklacebudi.lat/8	4c87a5a549.exe, 00000015.00000003.3466901864.000000000177D000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3472022362.000000000177D000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 00000015.00000003.3465636895.000000000177D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.founder.com.cn/cn	2fdda55cb5.exe, 00000008.00000002.2593299299.0000000009432000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/Z	4c87a5a549.exe, 0000000B.00000003.3336288412.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3310836119.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001E.00000002.3012967491.000002202D21F000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001E.00000003.2963178124.0000022039034000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	2fdda55cb5.exe, 0000000A.00000002.2598409866.0000000005C60000.00000004.08000000.00040000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000043BD000.00000004.00000800.00020000.00000000.sdmp, 2fdda55cb5.exe, 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/appId	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/complete/	firefox.exe, 0000001E.00000003.2942680167.000002203918E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://grannyejh.lat/k	4c87a5a549.exe, 0000000B.00000003.3285678585.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, 4c87a5a549.exe, 0000000B.00000003.3288267318.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpox	32e4f1cc69.exe, 0000000C.00000002.3219956673.0000000000947000.00000040.00000001.01000000.00000013.sdmp	false	unknown
http://mozilla.org/#/properties/isEnrollmentPausedUPDATE_CHECK_EXTENDED_ERROR_EXTERNAL	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://json-schema.org/draft-06/schema#	firefox.exe, 0000001E.00000002.3063248884.0000022032837000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.avito.ru/	firefox.exe, 0000001E.00000002.3013654008.000002202D3E0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/branches/anyOf/1/items	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled	firefox.exe, 0000001E.00000002.3044937144.0000022031862000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.157.253	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.64.1	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.132	unknown	United States	15169	GOOGLEUS	false
142.250.181.110	unknown	United States	15169	GOOGLEUS	false
34.117.188.166	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
64.233.162.84	unknown	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.21.21.99	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.17.78	unknown	United States	15169	GOOGLEUS	false
172.67.180.113	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.64.80	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.215.121	unknown	United States	13335	CLOUDFLARENETUS	false
20.233.83.145	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	unknown	United States	15169	GOOGLEUS	false
35.244.181.201	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	unknown	United States	15169	GOOGLEUS	false
34.160.144.191	unknown	United States	2686	ATGS-MMD-ASUS	false
142.250.181.99	unknown	United States	15169	GOOGLEUS	false
104.21.67.146	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578446
Start date and time:	2024-12-19 18:08:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@115/27@0/26
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 54% Number of executed functions: 199 Number of non-executed functions: 24
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Execution Graph export aborted for target 4c87a5a549.exe, PID 7704 because there are no executed function
Execution Graph export aborted for target 65996c3e29.exe, PID 5820 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:10:01	API Interceptor	17182713x Sleep call for process: skotes.exe modified
12:10:17	API Interceptor	2x Sleep call for process: 65996c3e29.exe modified
12:10:21	API Interceptor	1x Sleep call for process: 2fdda55cb5.exe modified
12:10:33	API Interceptor	932285x Sleep call for process: 4c87a5a549.exe modified
12:11:00	API Interceptor	437x Sleep call for process: 32e4f1cc69.exe modified
12:11:02	API Interceptor	40x Sleep call for process: powershell.exe modified
12:11:23	API Interceptor	68x Sleep call for process: cf64a9d6bd.exe modified
12:11:26	API Interceptor	119x Sleep call for process: b236e8b839.exe modified
17:09:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:10:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4c87a5a549.exe C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe
17:10:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4c87a5a549.exe C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe
17:10:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 32e4f1cc69.exe C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
17:10:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4e8d32508c.exe C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe
17:11:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f465aceff1.exe C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe
17:11:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 32e4f1cc69.exe C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
17:11:24	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
17:11:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4e8d32508c.exe C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe
17:11:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f465aceff1.exe C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe
17:12:45	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
17:15:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ea49fe03fc.exe C:\Users\user\AppData\Local\Temp\1017764001\ea49fe03fc.exe
17:15:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ea49fe03fc.exe C:\Users\user\AppData\Local\Temp\1017764001\ea49fe03fc.exe
17:16:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c162b8262c.exe C:\Users\user\AppData\Local\Temp\1017765001\c162b8262c.exe
17:16:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 937d0edbe0.exe C:\Users\user\AppData\Local\Temp\1017766001\937d0edbe0.exe
17:16:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c1f4793dd0.exe C:\Users\user\AppData\Local\Temp\1017767001\c1f4793dd0.exe
17:16:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c162b8262c.exe C:\Users\user\AppData\Local\Temp\1017765001\c162b8262c.exe
17:16:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 937d0edbe0.exe C:\Users\user\AppData\Local\Temp\1017766001\937d0edbe0.exe
17:16:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c1f4793dd0.exe C:\Users\user\AppData\Local\Temp\1017767001\c1f4793dd0.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.64.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
104.21.64.1	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	185.215.113.43
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
CLOUDFLARENETUS	https://ap1s.net/Dm7jH	Get hash	malicious	Unknown	Browse	172.67.73.44
	EFT Remittance_(Dmorris)CQDM.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	Timesheet ACH-Tbconsulting.November 16, 2024.html	Get hash	malicious	Unknown	Browse	172.66.47.118
	https://whtt.termlicari.ru/HnkNbg/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://go.eu.sparkpostmail1.com/f/a/lgobNkIfvQXGgmbryxpFvQ~~/AAGCxAA~/RgRpPCorP0QoaHR0cHM6Ly9iZXJhemVsLmNvbS93ZWxsbmVzcy9zb3V0aC9pbmRleFcFc3BjZXVCCmdVK6VZZ3GvOmFSFmV0aGFubG9nYW40M0BnbWFpbC5jb21YBAAAAAE~#a3RhdHJvZUBob3VzaW5nY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpen	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.24.14
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.177.88
	mirabon.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	188.114.97.6
	Doc_14-58-28.js	Get hash	malicious	Unknown	Browse	172.67.180.133
CLOUDFLARENETUS	https://ap1s.net/Dm7jH	Get hash	malicious	Unknown	Browse	172.67.73.44
	EFT Remittance_(Dmorris)CQDM.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	Timesheet ACH-Tbconsulting.November 16, 2024.html	Get hash	malicious	Unknown	Browse	172.66.47.118
	https://whtt.termlicari.ru/HnkNbg/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://go.eu.sparkpostmail1.com/f/a/lgobNkIfvQXGgmbryxpFvQ~~/AAGCxAA~/RgRpPCorP0QoaHR0cHM6Ly9iZXJhemVsLmNvbS93ZWxsbmVzcy9zb3V0aC9pbmRleFcFc3BjZXVCCmdVK6VZZ3GvOmFSFmV0aGFubG9nYW40M0BnbWFpbC5jb21YBAAAAAE~#a3RhdHJvZUBob3VzaW5nY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpen	Get hash	malicious	KnowBe4	Browse	104.17.25.14
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.24.14
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	172.67.177.88
	mirabon.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	188.114.97.6
	Doc_14-58-28.js	Get hash	malicious	Unknown	Browse	172.67.180.133

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse

Created / dropped Files

C:\ProgramData\AFCAAEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAEBGCFIEHCFIDGCAAFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCFCAAAAFBAKEBFBAKK (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2fdda55cb5.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: AWrVzd6XpC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1740288
Entropy (8bit):	7.934013006974825
Encrypted:	false
SSDEEP:	24576:ZOBEW2WpuodAZbMGsM4wyntABROmdIcVRYsaizzaTwuAPsdw79wiUlqghYDHeF:ZOKlcuMM4wyntuP+cUstH6FFlqgP
MD5:	B8236D5CA32C7E8A4EE704D69513D9BA
SHA1:	4588A955490AEB238F5A1DE8AD9F97E062777AE2
SHA-256:	A035D76DD3D3ACBE619CFF27FB9C937377E872F8A882EEC84FEFFD6112C00DCA
SHA-512:	A1A195028F2FA5C0CBB79E87C0690E4D33683AE10FBA258AEF18E564AF9FFD8BDCD4895E14AF263322A0C40EE82DF6619D9926CCAD77027B247CF085361AEC77
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@E.. ...`....@.. ........................E...........`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... .@..........8..............@...mlmzcfis.@..........:..............@...bcfyzdjq. ... E......h..............@....taggant.@...@E.."...l..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2912256
Entropy (8bit):	6.468854681987729
Encrypted:	false
SSDEEP:	49152:GQVGaZ0rtmZpg+0yayiTdbPURiSLwVeRVWqcZrfE6:xGa0kZphnayHiSLwGwVZrfp
MD5:	BD76F49B7C19E00500441410F691B98E
SHA1:	6A1D3DE33DDBEBBED18E734C034706BE8F0B52D3
SHA-256:	357A7F0C11C31DDA9E4EF81A28F6D9839B5940C8223C8934719983563317D6E7
SHA-512:	F8C599710AE69769B1510E7FFC2440C534D769A25C561584BD5DB3072D2CEF34C0435EF47F9E529A48614B85E2B67B874ED36661D0308217EA583415C1071017
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.......-...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...vsiixbzb.....$.....\|..............@...lhhqnhik......O......H,.............@....taggant.0....O.."...N,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	965632
Entropy (8bit):	6.692764370243885
Encrypted:	false
SSDEEP:	24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aqtde2:zTvC/MTQYxsWR7aqC
MD5:	99BF2F690B1735C1965C38009B3838C8
SHA1:	0E0AC7C5689EF30031D4CCB5F174A90A623451BD
SHA-256:	F76B62086A3E76C246CCC5D071A117E6899C45DD7D617EA4620174315F1FAE21
SHA-512:	CCD8A6015C7D287E4230401935400C50AE6D26B16EA4B6FD306793096AB8DE71E762B59BDB1D846319BDACD670DC3B107E5DF202716A61CB03D0B618D77DB10A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...&Tdg..........".................w.............@.......................... ......P.....@...@.......@.....................d...\|....@..dQ.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...dQ...@...R..................@..@.reloc...u.......v...F..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1784320
Entropy (8bit):	7.934831583504295
Encrypted:	false
SSDEEP:	49152:5ABgpBcVxsofHFeSOeKKK1dB9JvrAtUb:56BHkSOB1/DAtUb
MD5:	76A8BF3F8832AD9EA271581CF46BE4B0
SHA1:	CC2127F37569781FEBC07DC06FAAD6905C04A1C4
SHA-256:	2D6F7626FE564CDF51A5A8238B0253A5272C2C138E6274E1EE12D0DA3F65C47A
SHA-512:	BDE1BE1405880EDD9A91E12599A7CC59D111A1DAF4F435714FCB25DA1046BA6564512987159227B005F92D8B3FE19E43FA72414EB0C2876F0709E622602DAA0E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............F.. ...`....@.. ........................G.....-C....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . +..........8..............@...mepijjqp......+......:..............@...sxjadjho. ....F.....................@....taggant.@....F.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1845248
Entropy (8bit):	7.947534742466939
Encrypted:	false
SSDEEP:	49152:cGjd2aZyJQRC4eAVzGEtN1pDkhznzut/2iv:njdxDeA0EtNTDSzun
MD5:	DBF748514EB0FC59B54EEC27DA278552
SHA1:	560C98E2A75723A0197B6AE15A2E80722780F833
SHA-256:	652153F3FA503F2195EBA2B5A62AC610183E2E1EDA924E9A54601B919414642F
SHA-512:	D67E991D4D63E6297C7FE0F548EE8B23B8EC875A865C6615DF9C5C1A3C97D9A298BD8BE5BEE4AC9008BC9B9401174B5CA7CCDA7430EA515D340A24AC6AE96FA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... .P*..@.......\..............@...mjanwrqb....../......^..............@...poqismoi.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2862592
Entropy (8bit):	6.492740520759297
Encrypted:	false
SSDEEP:	49152:ptaY+7Eiqxf5bBMRtUWPJcbbcPX3yl413862:TE7vqxzMR2sgbcPXCl41n2
MD5:	87EBB8C3E3EC5A31C8D50C80357F18AE
SHA1:	D2A4FC99F757E836D433C65CDC940BD195A797BF
SHA-256:	9A4F1D82E1719A9F29B4A39041B43C7F7DFF5F1FEB20501B371E049E8FB6C0BB
SHA-512:	71427D196695EDC0215D3463E35CC3313D5A84A5395B457F12477705CE9A6A4D6EFBCC689CC535F0C1F247283F7FD59410BCA54CEA6E7B1264780E721214B6C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........N...........@...........................O.....a.,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...wokzrztg.....$.....\|..............@...eojqxzlp......N.......+.............@....taggant.0....N.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970752
Entropy (8bit):	6.70341918278839
Encrypted:	false
SSDEEP:	24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8ayz0Z:iTvC/MTQYxsWR7ayz0
MD5:	FC3C8F3D665C9EB3D905AEA87362077D
SHA1:	8B29DD19ED26788ECFCBEC0EAD4C9EC9E3E39C0A
SHA-256:	1337DE6616E1FEFF4FF22F5F150ACEA05B13761C538C29138D955A5AD73B9DE7
SHA-512:	D131EEC2D51DA20CC03822FCA83ED94861E863D42B9F1CA5F4A1CB24276086E36BE353CC0EAD01FDBA9E489C4F5032835B4540A923E688124BB32ACC8C70F16F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...:Edg..........".......... ......w.............@..........................0......?.....@...@.......@.....................d...\|....@..(e.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(e...@...f..................@..@.reloc...u.......v...Z..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1784320
Entropy (8bit):	7.934831583504295
Encrypted:	false
SSDEEP:	49152:5ABgpBcVxsofHFeSOeKKK1dB9JvrAtUb:56BHkSOB1/DAtUb
MD5:	76A8BF3F8832AD9EA271581CF46BE4B0
SHA1:	CC2127F37569781FEBC07DC06FAAD6905C04A1C4
SHA-256:	2D6F7626FE564CDF51A5A8238B0253A5272C2C138E6274E1EE12D0DA3F65C47A
SHA-512:	BDE1BE1405880EDD9A91E12599A7CC59D111A1DAF4F435714FCB25DA1046BA6564512987159227B005F92D8B3FE19E43FA72414EB0C2876F0709E622602DAA0E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............F.. ...`....@.. ........................G.....-C....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . +..........8..............@...mepijjqp......+......:..............@...sxjadjho. ....F.....................@....taggant.@....F.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ry2jzev.nsc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_53abxoug.quf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3016192
Entropy (8bit):	6.514293377448017
Encrypted:	false
SSDEEP:	24576:ed/VVseAYPHvO7oh0V0nqKd/66xjvvtAvqXe4O57d7O0wtiTYLg60wZ1OpvEZP3j:o1AOH28hJyyEFO0wtIkP3yiBSwtD
MD5:	F8FC64F50BE9AC7C2757AE0DC1FECAE9
SHA1:	A8548A7FE4DB8133E0287AA0E0E30C22BD607268
SHA-256:	5272AAE23B880E421EFDE22A6ABB98DC13A20BF5101FB0391D8981BE82D1C1DD
SHA-512:	A4A15B36105B05B1FE82B3DA36412FD8F464341D04C6D3E8C4D66736B89965D15B8DF0C342164B2F6653AED62848A8C89AA716D567FD0581D8CE3928AA9F06B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 44%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....+.....@.................................W...k...........................t.1.............................$.1..................................................... . ............................@....rsrc...............................@....idata ............................@...qokzkhtc..........................@...cvovnsld......1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9881
Entropy (8bit):	5.532157987860486
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6mhj4qyaaX86KakfGNBw8dJSl:dekquOcwm0
MD5:	4C0BC5265C795ECF4F19E1B9645652DA
SHA1:	784D23EC56DABC55460302EA51B439B86EA7213D
SHA-256:	591C90B81012D0FACEF2D6E051C03DF9F769DC1DC733DBFAE1532909B8D91F21
SHA-512:	AC8863CC4751FCDBE8D563807E9EA6111DC599FF922877ADE54CAF8C37BCFFFF5C7BA1DA92A77E20BC40B59118846B19C214787AFD0EEE3462F940DB987CA9F3
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9881
Entropy (8bit):	5.532157987860486
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6mhj4qyaaX86KakfGNBw8dJSl:dekquOcwm0
MD5:	4C0BC5265C795ECF4F19E1B9645652DA
SHA1:	784D23EC56DABC55460302EA51B439B86EA7213D
SHA-256:	591C90B81012D0FACEF2D6E051C03DF9F769DC1DC733DBFAE1532909B8D91F21
SHA-512:	AC8863CC4751FCDBE8D563807E9EA6111DC599FF922877ADE54CAF8C37BCFFFF5C7BA1DA92A77E20BC40B59118846B19C214787AFD0EEE3462F940DB987CA9F3
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4026896681219503
Encrypted:	false
SSDEEP:	6:z77tXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHtZut0:v7Zf2RKQ1CGAFAjzvYRQVHGt0
MD5:	338CF1BF73F6EE3FA3C1DD90B24B6034
SHA1:	5844CE3649AD4D4246D89FE46D019B7C0761C270
SHA-256:	A44472447B6F1B7544CF780B0381C82DD41749DCAFD0D512D55D0DABCE765A7D
SHA-512:	5CDC4A6A79245C1436A3744CBBEA790AB67D19ED1616717E5918C27F531BECF5548937597DBEE2FACEC0D34DCA10E729EA08010978C7625ABCA946A7EC68050F
Malicious:	false
Reputation:	unknown
Preview:	.....*...[eN."..E+,2F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.514293377448017
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'016'192 bytes
MD5:	f8fc64f50be9ac7c2757ae0dc1fecae9
SHA1:	a8548a7fe4db8133e0287aa0e0e30c22bd607268
SHA256:	5272aae23b880e421efde22a6abb98dc13a20bf5101fb0391d8981be82d1c1dd
SHA512:	a4a15b36105b05b1fe82b3da36412fd8f464341d04c6d3e8c4d66736b89965d15b8df0c342164b2f6653aed62848a8c89aa716d567fd0581d8ce3928aa9f06b3
SSDEEP:	24576:ed/VVseAYPHvO7oh0V0nqKd/66xjvvtAvqXe4O57d7O0wtiTYLg60wZ1OpvEZP3j:o1AOH28hJyyEFO0wtIkP3yiBSwtD
TLSH:	3CD56D616905B1CFD84F277C64A7CE82996D03FA071048D3EA6C787B7DA3DC522B6D28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA86C84067Ah
pmulhuw mm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x319574	0x10	qokzkhtc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x319524	0x18	qokzkhtc
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	8cb6ae91863ea3e3863d4be864c6dc1c	False	0.9977594942098093	data	7.978692736276461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x400	1a4f5a768491a91b128e9519db0ee74a	False	0.7109375	data	5.830351134872887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qokzkhtc	0x6b000	0x2af000	0x2aec00	c9f06abe5adf1c0ed5b01eac171d2865	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cvovnsld	0x31a000	0x1000	0x400	ae42a0a001b93427567b787d006cb048	False	0.8544921875	data	6.475452645408658	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x31b000	0x3000	0x2200	2cc9cbf86aee9a632a148a8c1fb4784b	False	0.09099264705882353	DOS executable (COM)	1.1588533360451185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x319584	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x319968	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	12:08:57
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x520000
File size:	3'016'192 bytes
MD5 hash:	F8FC64F50BE9AC7C2757AE0DC1FECAE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1689016313.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:09:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x890000
File size:	3'016'192 bytes
MD5 hash:	F8FC64F50BE9AC7C2757AE0DC1FECAE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1720825276.0000000005040000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 44%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:10:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x890000
File size:	3'016'192 bytes
MD5 hash:	F8FC64F50BE9AC7C2757AE0DC1FECAE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2312159104.00000000046D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:10:13
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017744001\65996c3e29.exe"
Imagebase:	0x690000
File size:	1'885'696 bytes
MD5 hash:	25FB9C54265BBACC7A055174479F0B70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:10:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"
Imagebase:	0x980000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:10:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017745001\2fdda55cb5.exe"
Imagebase:	0xee0000
File size:	1'114'112 bytes
MD5 hash:	EF08A45833A7D881C90DED1952F96CB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2596786814.0000000005860000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2590927332.0000000003513000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2594271186.00000000042F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000A.00000002.2590927332.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:10:29
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Imagebase:	0xa00000
File size:	1'845'248 bytes
MD5 hash:	DBF748514EB0FC59B54EEC27DA278552
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.2680187872.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.3203898816.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000003.3212168666.00000000007D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:10:38
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"
Imagebase:	0x7e0000
File size:	2'862'592 bytes
MD5 hash:	87EBB8C3E3EC5A31C8D50C80357F18AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.3245465248.000000000136E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000002.3219956673.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3219956673.00000000008B4000.00000040.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000C.00000003.2697039988.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:10:41
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Imagebase:	0xa00000
File size:	1'845'248 bytes
MD5 hash:	DBF748514EB0FC59B54EEC27DA278552
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:10:46
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"
Imagebase:	0x420000
File size:	970'752 bytes
MD5 hash:	FC3C8F3D665C9EB3D905AEA87362077D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:10:46
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:10:46
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:10:48
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:10:48
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=2148,i,17586504940363109766,5226812246577533475,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:10:49
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:10:49
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017747001\4c87a5a549.exe"
Imagebase:	0xa00000
File size:	1'845'248 bytes
MD5 hash:	DBF748514EB0FC59B54EEC27DA278552
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3493290951.0000000001718000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3492616015.00000000016FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3429198875.0000000001707000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	12:10:50
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:10:50
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:10:50
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:10:50
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:10:51
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:10:51
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:10:51
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:10:51
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:10:51
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	12:10:52
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2228 -prefMapHandle 2220 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a220cca7-9a24-45c9-9dc1-cb9c5bbde0e6} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 2202116ed10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	12:10:54
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"
Imagebase:	0x100000
File size:	1'784'320 bytes
MD5 hash:	76A8BF3F8832AD9EA271581CF46BE4B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	12:10:57
Start date:	19/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3796 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 3768 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fef79822-522c-4b3e-9b9c-fe49e006e0b7} 8100 "\\.\pipe\gecko-crash-server-pipe.8100" 220339fa110 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:10:59
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017748001\32e4f1cc69.exe"
Imagebase:	0x7e0000
File size:	2'862'592 bytes
MD5 hash:	87EBB8C3E3EC5A31C8D50C80357F18AE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000003.2900882871.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.3295527171.00000000007E1000.00000040.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000022.00000002.3306873384.00000000014EB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	12:10:59
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017751001\cf64a9d6bd.exe"
Imagebase:	0x4b0000
File size:	22'016 bytes
MD5 hash:	04F57C6FB2B2CD8DCC4B38E4A93D4366
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000023.00000002.3246036517.0000000003A00000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000023.00000002.3246036517.00000000038DB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	12:10:59
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	12:11:02
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\hhxex"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	12:11:02
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	12:11:07
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017749001\4e8d32508c.exe"
Imagebase:	0x420000
File size:	970'752 bytes
MD5 hash:	FC3C8F3D665C9EB3D905AEA87362077D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	12:11:09
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	12:11:09
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	12:11:10
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	12:11:10
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	12:11:12
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017752001\197a50e0cf.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	12:11:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017750001\f465aceff1.exe"
Imagebase:	0x100000
File size:	1'784'320 bytes
MD5 hash:	76A8BF3F8832AD9EA271581CF46BE4B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	12:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff651590000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	12:11:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	12:11:19
Start date:	19/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff69ad90000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	12:11:19
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xaa0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	12:11:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xaa0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	12:11:21
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017753001\b236e8b839.exe"
Imagebase:	0xd90000
File size:	1'880'576 bytes
MD5 hash:	FF279F4E5B1C6FBDA804D2437C2DBDC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3520830366.0000000000A33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000034.00000003.3515342718.0000000000A33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	12:11:21
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xaa0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	12:11:21
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	12:11:21
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	12:11:22
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x6a0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	748
Total number of Limit Nodes:	24

Executed Functions

Function 0055652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0055652A,?,?,?,?,?,00557661), ref: 00556567

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bc3293d1bc4ad283ad7d1781c893feaf62c81a214b06151982066fe9d3e60f4f
Instruction ID: d5dc6ef82f5e0cee2f76a616dae4915134684f1de505c2b07f90ebd31496d751
Opcode Fuzzy Hash: bc3293d1bc4ad283ad7d1781c893feaf62c81a214b06151982066fe9d3e60f4f
Instruction Fuzzy Hash: E3E08630081148AFCF257B18C82DD487F59FB9174AFC14811FC1487122DB25EE41C640

Function 04A10D14 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732147843.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a15642af66cb449b8ead29996d85b5ad5f77fa79808d4dff05ed83a1ac58f2e
Instruction ID: 35527f5909f8f7d6d1f854ea5e457afa45bd35b92e66ba885e278668c2da9463
Opcode Fuzzy Hash: 1a15642af66cb449b8ead29996d85b5ad5f77fa79808d4dff05ed83a1ac58f2e
Instruction Fuzzy Hash: B9F027BB20C2108F6202AA91A3900B737B29B97334F3088B1F443CB342E6B07D457201

Function 00525C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00526098
00000423, xrefs: 005260FA
Keyboard Layout\Preload, xrefs: 00526054
00000422, xrefs: 005260C9
0000043f, xrefs: 0052612B

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 9db276fcf7697ea10fbaeeccb739ff504501ea1f9540e5227ad6462ab4612c5d
Instruction ID: e702eba47ff12ff10becbcd3911db071a6c7d28a920dcd90c6ef55bdbfca1b88
Opcode Fuzzy Hash: 9db276fcf7697ea10fbaeeccb739ff504501ea1f9540e5227ad6462ab4612c5d
Instruction Fuzzy Hash: AEF1D0709002599BEB24DF54CD89BEEBBB9FF45304F5042A9F908A72C1DB759A84CF90

Function 00529BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 9d5337ff27e940548a732c75c389e2076b7ce1105329bbba695703de41a313d3
Instruction ID: dedd5ea31e27f8e7967c3b664cf61e007fb22b5d807cd1764ab1642afe0701ff
Opcode Fuzzy Hash: 9d5337ff27e940548a732c75c389e2076b7ce1105329bbba695703de41a313d3
Instruction Fuzzy Hash: 77311471A042148BEB08DB68ED8976DBFB2BFD7314F248228E414A73D6C77699808761

Function 00529F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 8975eb1e00721d57d1a445fcac6a2e617271d42a30f24e6d1522e879ba398c33
Instruction ID: 6967976d9686336dba799b3bd8a224ef9250111612b3a10706c0fc7fc6cdd2f2
Opcode Fuzzy Hash: 8975eb1e00721d57d1a445fcac6a2e617271d42a30f24e6d1522e879ba398c33
Instruction Fuzzy Hash: C1312731A002108BEB18DB78E9897ADBFB2FFC6314F208619E414E73D6D73659808752

Function 0052A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: a1245cf69bfd965606f457cb294f2aee762caeded6a57b6d501e42a25d9315f5
Instruction ID: 2ce150bc17a4233565e42c1f75df217ff0c0308478d2cedbe745d4e7206f0392
Opcode Fuzzy Hash: a1245cf69bfd965606f457cb294f2aee762caeded6a57b6d501e42a25d9315f5
Instruction Fuzzy Hash: AC310531A002109BEB18DB78ED89B6DBF72BFD2314F248618E414A72D6D77699908752

Function 0052A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 603cee2de98ca90bac7a01bfc36d424cd7c2de6bd551aa90358cf6666db90e5e
Instruction ID: 567dddb46fd3df25a2509f1fe142b9dca3fa4307abb8143658e0699a25a202c6
Opcode Fuzzy Hash: 603cee2de98ca90bac7a01bfc36d424cd7c2de6bd551aa90358cf6666db90e5e
Instruction Fuzzy Hash: BD312631A00251DBFB08DB78ED89B6DBF72BFC7314F208618E014A72D6D77699808752

Function 0052A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: aeef3c7c73c244cbb725c8a83ca1dd4614e39aba2c2fc2609450c48de1f97299
Instruction ID: 2e94bad8cab066073803a0e186c3fa55fbaa43683c7bee51a2fd23954fa5556f
Opcode Fuzzy Hash: aeef3c7c73c244cbb725c8a83ca1dd4614e39aba2c2fc2609450c48de1f97299
Instruction Fuzzy Hash: 41312B31A002509BEB08EB78E88D76DBF72FFD2314F204619E414973D6DB7599848792

Function 0052A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 86d9a7073f264541bf2ccabd1216f29f7dc255b912983e530ce10b42060f9748
Instruction ID: f66c7989f6f3dab65753f13b7b09675e4992a1cd1f4913af5ab507a21bfccdae
Opcode Fuzzy Hash: 86d9a7073f264541bf2ccabd1216f29f7dc255b912983e530ce10b42060f9748
Instruction Fuzzy Hash: 39310731B002518BEB18DB78E8C9B6DBF72BFC7314F248618E4149B2D6DB7599848752

Function 0052A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 95a99ceba0c0e2390852d62e25202d38bdf100e4b9a267d951bf3ed46b20cc53
Instruction ID: bc17605a5249c1ede4322f476e3213f18ec0f88e8d94020cfe49e47b8ea25d54
Opcode Fuzzy Hash: 95a99ceba0c0e2390852d62e25202d38bdf100e4b9a267d951bf3ed46b20cc53
Instruction Fuzzy Hash: 7B312831A002508BEB08DB78EC8976DBFB2FFC2314F248618E4149B2D6C77559808766

Function 00529ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: bbe3dffe7f47ffdf930d0119ba8001f2caa1a055b98c1ae5fe18275e7247e044
Instruction ID: 17a3658922d2cf9b75e3940c59edfd3afc36aa684ee6a135bfd706fbcb9802cb
Opcode Fuzzy Hash: bbe3dffe7f47ffdf930d0119ba8001f2caa1a055b98c1ae5fe18275e7247e044
Instruction Fuzzy Hash: CC213731604211DBEB189F68FCC972DBF62FFC2314F204229E418973D6DB7659908751

Function 0052A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 8ccd31f277a7105ff03a459a4aba315018d98b30154369addf5ea6b0fc21dfb1
Instruction ID: 1f2562b346772c954e9f9a1fa850906fb8aed064c5e72a705539d247498e9663
Opcode Fuzzy Hash: 8ccd31f277a7105ff03a459a4aba315018d98b30154369addf5ea6b0fc21dfb1
Instruction Fuzzy Hash: A9216D316442128BF728AB68B99E73DBF52FFC7300F204816F508963C3CB7648819293

Function 0052A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0052A963
CreateMutexA.KERNEL32(00000000,00000000,00583254), ref: 0052A981

Strings

T2X, xrefs: 0052A970

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2X
API String ID: 1464230837-473223881
Opcode ID: 057ef33aca2d2b8fa7907d3e0307989fa4796493050829919da7e915c5ee8c50
Instruction ID: 84e6654d7ad9c189aed013899d44e61c247b5a3c6b7ee6fe002250897f7b095f
Opcode Fuzzy Hash: 057ef33aca2d2b8fa7907d3e0307989fa4796493050829919da7e915c5ee8c50
Instruction Fuzzy Hash: A82167326042009BEB18DB28FC8972CBFB2FFE2714F204629E404972D5CB7659808352

Function 00527D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00527ED3

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 8972c0323adf3f573c1ad99a15e1371cf5ff4db788c4c3e3b8c73e866e053227
Instruction ID: 619625b80ac60e539dff800e3eea9ac259b70dc409bcfec37fab4e5132d6d7de
Opcode Fuzzy Hash: 8972c0323adf3f573c1ad99a15e1371cf5ff4db788c4c3e3b8c73e866e053227
Instruction Fuzzy Hash: 69E1D470E006599BDB24FB689C0B3AD7F61BF86720F944698E815773C2EB354E8487C2

Function 0055D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0055A813,00000001,00000364,00000006,000000FF,?,0055EE3F,?,00000004,00000000,?,?), ref: 0055D871

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 532c19f21c04749285b630e5cbf3c43b2bf1b3b03d8e6f7dc1ef9d492a00ba1f
Instruction ID: ce47331ddff0d38c210114709f98de5a3e3ae6a771ffc3af8d98927fc596568a
Opcode Fuzzy Hash: 532c19f21c04749285b630e5cbf3c43b2bf1b3b03d8e6f7dc1ef9d492a00ba1f
Instruction Fuzzy Hash: DFF0B433501525669B312A629C25A6B3F78FB95373B148423AC04E7181DA21D80C86F0

Function 005287B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0052DA1D,?,?,?,?), ref: 005287B9

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 60f77069d59dadf4c8a7ddb1b660142b29bd9d0ab5d3c383e26e82455bf780c2
Instruction ID: 01b3b7cd4daad98b6ac4646d3842d42318288b8b359e33cf740a5e76031845d3
Opcode Fuzzy Hash: 60f77069d59dadf4c8a7ddb1b660142b29bd9d0ab5d3c383e26e82455bf780c2
Instruction Fuzzy Hash: 73C08C2902361005FD1C49B820858B83B46ED877A83FC1BC4E0704B1E2CA3768079250

Function 005287B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0052DA1D,?,?,?,?), ref: 005287B9

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c7fde4d9ee375f9b4d009beabad05206262199e89ffdd2909b3bd1a99a03b787
Instruction ID: bbdb5b7b6e70e29e080164652b9422b93a67869d3f23a7317cbc7cebf4af3d3b
Opcode Fuzzy Hash: c7fde4d9ee375f9b4d009beabad05206262199e89ffdd2909b3bd1a99a03b787
Instruction Fuzzy Hash: 79C08C3902321046FA1C8AB860848383A16FE8372C3FC0B98E0314B1E2CB33D803C6A0

Function 0052B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0052B3C8

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e3da13c545787e7efc88d8cba3dc8e5f20c8f3790b84840fd11edbe6564a531d
Instruction ID: 68920708d424a4c4758986e4e26eed63cb3d9971868c3ebb33ee02924e11d3b6
Opcode Fuzzy Hash: e3da13c545787e7efc88d8cba3dc8e5f20c8f3790b84840fd11edbe6564a531d
Instruction Fuzzy Hash: C2B10570A10268DFEB28CF14C998BDEBBB5FF56304F5045D9E80967281D775AA88CF90

Function 04A10CE2 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732147843.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62138e590e5f40b10b979ca9146e6de01b5b41e7dbc3c621dc6e852044272ba6
Instruction ID: 79a52ade5a0262c494dc166fc60b62f0759d338eb1422100364208d98886cf79
Opcode Fuzzy Hash: 62138e590e5f40b10b979ca9146e6de01b5b41e7dbc3c621dc6e852044272ba6
Instruction Fuzzy Hash: B71129FB24C2017EF6029A9167005F63BB9EBD7330B308876F442CB911E2A1698A7634

Function 04A10D22 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732147843.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87762dc4254dc1f276f0c6bc50ee2428a90b4168c67cbb6c31b21926ddafce7
Instruction ID: 106035c72537f144e3dbc124a465dcab09e20028e78b5995e61762893d485af9
Opcode Fuzzy Hash: c87762dc4254dc1f276f0c6bc50ee2428a90b4168c67cbb6c31b21926ddafce7
Instruction Fuzzy Hash: 3A017BAA28C201AFA6036AA082440B73F75FB93334B345CB5F4C3CB912E6E17C45A611

Function 04A10CDB Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732147843.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65da135a21b10210216dc3835d2292b76e9ade3c496a6ce6b18cde7dac00f0a3
Instruction ID: d11df81b20eb43b79d101c0827a760933944a38e3e4ad84a6d3d811e0603e322
Opcode Fuzzy Hash: 65da135a21b10210216dc3835d2292b76e9ade3c496a6ce6b18cde7dac00f0a3
Instruction Fuzzy Hash: 9DF0E9FA28C2116EA1036A5157440777AB9BB93334B704875F843CF611FBF07D487621

Function 04A10D62 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732147843.0000000004A10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edaf2a9891c20cc7f2dff534737b3c4dedc20c11da3817e70a7a42ad03662281
Instruction ID: 77d2e9f3d960b29b2edeb3244f7dccafa0d36c35a7e85a332d72b6d69a51ea17
Opcode Fuzzy Hash: edaf2a9891c20cc7f2dff534737b3c4dedc20c11da3817e70a7a42ad03662281
Instruction Fuzzy Hash: 57D0A77954C312CFA6602FF543481BB36B17B13235F504839E44386821EBA4B6847501

Non-executed Functions

Function 005631A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00563323

Strings

1#QNAN, xrefs: 005644C1
1#SNAN, xrefs: 005644BA
1#INF, xrefs: 005644DE
1#IND, xrefs: 005644B3

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: fcb0a60753cc3a7d45c1580c3a7f2d367873fe534bbdb625d4817d01b1760c05
Instruction ID: f27f5543b9e675febe4dbe5167acdec4e0200147b0f05090b48d1b3cbade347c
Opcode Fuzzy Hash: fcb0a60753cc3a7d45c1580c3a7f2d367873fe534bbdb625d4817d01b1760c05
Instruction Fuzzy Hash: 71C24971E046298FDB24CE28DD447EABBB5FB88305F1445EAD84EE7240E775AE858F40

Function 0052E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0052E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0052E140

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 3ab5af3c509fd289c327b5cd321ebfd91ac912c9b377d71e8b33679888ec690b
Instruction ID: edb501cb2a123b3144ccae2695ff2eae2e41dfe68d0d20927d734e731ed79c47
Opcode Fuzzy Hash: 3ab5af3c509fd289c327b5cd321ebfd91ac912c9b377d71e8b33679888ec690b
Instruction Fuzzy Hash: DD31D771A002549BDB20CB68DC86BAB7FA8FB19724F440625E915F72D1C674A849CB60

Function 00562D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 1448f8c10ebe4f2e25e7d40e0d2833fc01c1e820b461008624c0acb9ae178fee
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: E5F15F71E002199FDF14CFA8C8846ADFBB5FF89324F258269D819AB345D731AE45CB90

Function 0053CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0053CF52,?,00000003,00000003,?,0053CF87,?,?,?,00000003,00000003,?,0053C4FD,00522FB9,00000001), ref: 0053CC03

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: f41314395ec3d0bd3d8a61aef83d7f55f4f769dac6df58dd6f0f57520a13d271
Instruction ID: f631d6071e7cd96746235acc412dc68a649f5e86460d8c0abc93cbe8dc536d03
Opcode Fuzzy Hash: f41314395ec3d0bd3d8a61aef83d7f55f4f769dac6df58dd6f0f57520a13d271
Instruction Fuzzy Hash: 63D0223290213CD38A012B94FC048ADBFC8EB00B64B002021ED0C73120CE50BC406FD1

Function 00557F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 005580B2

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: f3e771f2f42974948997c547b59e2357a37ebfc41eda9f080a452f5fdcffa439
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: EE515B3020864D5ADB38D62898BD7BE6F967F55303F14051BEC82F72E1CD519D8D8351

Function 00524DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca39c051f1f31aa2c6666e24fa3e3fa99a2ba12492641d04009c12495537dba
Instruction ID: 8e02160b22b25082350583cc5a9ad6fd582e3376e0262dee6d1403719314ec26
Opcode Fuzzy Hash: 0ca39c051f1f31aa2c6666e24fa3e3fa99a2ba12492641d04009c12495537dba
Instruction Fuzzy Hash: 5B2270B3F515145BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00567049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e793f2fd75348e634712e8a1c0313ae1baae8be94188d2e6b609919b49ee343a
Instruction ID: 985a98a07ed7a0fa9d8c07aa2101739d31d7564595a46854f5febfb93923d61b
Opcode Fuzzy Hash: e793f2fd75348e634712e8a1c0313ae1baae8be94188d2e6b609919b49ee343a
Instruction Fuzzy Hash: A0B15D35614609CFD728CF28C49AB657FE0FF49368F258659E899CF2A1C335E982CB40

Function 00524B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039753a473ff415b20b566581e1974d0e128b1ace109e3a0b9de4aa431545821
Instruction ID: 867d783cee981b90f38a717f204a461bc0605e0ca69f096cb53ba3361c45a800
Opcode Fuzzy Hash: 039753a473ff415b20b566581e1974d0e128b1ace109e3a0b9de4aa431545821
Instruction Fuzzy Hash: 0981FE71A052668FDB15CF68E8907BEBFF1BF5A300F5406A9DC50A7392C3359949CBA0

Function 00638101 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35991c2bf02517fc22fe8b50b04c8a8784f3a314a6c805750df13007d77d6dce
Instruction ID: 003ef413147335cabc9bd1aa915d1691f34436c7ddf51962a5f9ae0e7734a7b4
Opcode Fuzzy Hash: 35991c2bf02517fc22fe8b50b04c8a8784f3a314a6c805750df13007d77d6dce
Instruction Fuzzy Hash: A8418DF7F116214BF3444979DD883526A839BD5314F2B82788E5CAB7CADC7E5C0A4284

Function 005678BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff703f6ff48abb8a00d53cf137259bc5b8eb442a5b92e2acb4e3ab9977fcaea
Instruction ID: e86913bb2b6b11d45285c1762d5e13b81eebd8673442d34ad2bc7c82e62d5c6e
Opcode Fuzzy Hash: 2ff703f6ff48abb8a00d53cf137259bc5b8eb442a5b92e2acb4e3ab9977fcaea
Instruction Fuzzy Hash: 4521B673F2043947770CC47E8C5627DB6E1C78C641745423AE8A6EA2C1D968D917E2E4

Function 0056779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacf2b4b51e0f6384588730212f701817ee1ab49e05fab8ae1ca048120d988ec
Instruction ID: 8c3500119752a3a40ffa1a8c6d7323ffc6ef18c185e2d5270b51f34d4e959e31
Opcode Fuzzy Hash: dacf2b4b51e0f6384588730212f701817ee1ab49e05fab8ae1ca048120d988ec
Instruction Fuzzy Hash: FC117323F30C295A675C816D8C172BAA5D2EBD825471F533AD826E7284E9A4DE23D290

Function 00568860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 2d351b8169ab2be0217f55dafd3f322ef79fe9578315222bc8bf16dd5ceacd4d
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 9311507724018243E604C63DC8F45B7EF95FBC53217AC4B7AD0414B759DE23D9459600

Function 0055A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: e2640cd9a8f76b5d1d4284772a2607f779712e7b9e4b5501217c1ccdb32e4c64
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 57E08C32921228EBCB14DBD8C91898AFBECFB89B05B660597F901D3150D270DE08C7D0

Function 0055CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055CC66

Strings

vU, xrefs: 0055CBE1

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vU
API String ID: 3213747228-2253778839
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 249b4cc94f3d847147b1ccd7e635adbe53b5af5935a81b9722c67ee9cbfdc994
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 2DB1F1329043869FDB128F28C8A27AEBFB5FF46341F14416BDC55EB242D6349D49CB60

Function 00522EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00522F5F
__Mtx_unlock.LIBCPMT ref: 00522FCC
__Mtx_unlock.LIBCPMT ref: 005230F5
__Mtx_unlock.LIBCPMT ref: 0052319B

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 7dcca527c9ced4f70c7197afab47f91e643b9d7671c5c3d64f5e6a6f3a1d3ba0
Instruction ID: e5d180885f11420927d946c9962ba46039b47f9fc83b4decd45e887719a30f2d
Opcode Fuzzy Hash: 7dcca527c9ced4f70c7197afab47f91e643b9d7671c5c3d64f5e6a6f3a1d3ba0
Instruction Fuzzy Hash: D5A103B0A01226EFDB10DF64D94975ABFB8FF56310F048529E815E7281EB35EA14CBE1

Function 0055F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0055F3A3

Strings

`'X, xrefs: 0055F375
8"X, xrefs: 0055F44B

Memory Dump Source

Source File: 00000000.00000002.1729423025.0000000000521000.00000040.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.1729406195.0000000000520000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729423025.0000000000582000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729484611.0000000000589000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729501380.000000000058B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729519821.0000000000597000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729629121.00000000006FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729648301.00000000006FC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729670627.000000000070E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729688363.000000000070F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.0000000000710000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729706040.000000000071A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729744157.000000000071D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729763572.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729783332.000000000072E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729802136.0000000000734000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729823091.0000000000749000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729839752.000000000074B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729858952.0000000000755000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729894569.000000000075D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729912017.000000000075E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729930038.0000000000761000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729951939.0000000000777000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729970329.000000000077A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1729989017.0000000000784000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730006586.0000000000788000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730021959.0000000000789000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730037685.000000000078E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730053086.000000000078F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730069138.0000000000792000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730088748.00000000007A8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730105777.00000000007B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730122930.00000000007B8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730139875.00000000007BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730168145.00000000007E7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730184492.00000000007F4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730222412.000000000080C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730238208.000000000080E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730257500.0000000000824000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730273571.0000000000825000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730289878.0000000000829000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730305527.000000000082B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730324656.0000000000839000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1730351763.000000000083B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"X$`'X
API String ID: 3903695350-2618657942
Opcode ID: fa990b73fc6fe993c90faeca9d8edfaed69842d053e3719e94c9c49673bce2da
Instruction ID: ee77e0b927020d6adae6c9c4d8ff2813fcee3c2226c926606cbc6c7c2efa805b
Opcode Fuzzy Hash: fa990b73fc6fe993c90faeca9d8edfaed69842d053e3719e94c9c49673bce2da
Instruction Fuzzy Hash: DA316D31600202DFEB21AA39D899B5B7BE8FF40353F10492BE845D7595DF70AC88CB21

Analysis Process: skotes.exePID: 7520, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	632
Total number of Limit Nodes:	4

Executed Functions

Function 008C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,008C652A,?,?,?,?,?,008C7661), ref: 008C6567

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 3e224b38e74eb8cd5773be3dc65c6a6630f05e031fe72e042a527f9b038cdd44
Instruction ID: 3e968e7bccaf5330e1fc46fe5e45907062fad1e43a665ceb2943f307c143b887
Opcode Fuzzy Hash: 3e224b38e74eb8cd5773be3dc65c6a6630f05e031fe72e042a527f9b038cdd44
Instruction Fuzzy Hash: 0DE08C30151548AFCF2ABB68C85DF493BB9FF61B45F200828FC18C6222DB35DE91CA81

Function 00899BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8c7680e21920ce313e10d4399c397a51aadd0130df7cba3c3ef7efb08be8e8b8
Instruction ID: 69ed7d4783c7784df6eaf9ea1a63fb3a75a7df5b5f02e3d89f19b73eec93c35d
Opcode Fuzzy Hash: 8c7680e21920ce313e10d4399c397a51aadd0130df7cba3c3ef7efb08be8e8b8
Instruction Fuzzy Hash: B73105717042448BEF08BB7CDCC9B6DBA62FB86324F28461CE055D77D6C77989808792

Function 00899F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 33208a16121908246b10d4b792ec7b7026e4665d068d4579e2c3fae0e9dca03e
Instruction ID: 770b5bf046b1353e9f623c4d38505ae11088e06efbe5918f569aba2b8740a6a2
Opcode Fuzzy Hash: 33208a16121908246b10d4b792ec7b7026e4665d068d4579e2c3fae0e9dca03e
Instruction Fuzzy Hash: F53105317002449BEF1CAB7CDC89BADFB62FB86310F28461CE455D76D5DB7689808792

Function 0089A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 52171c5dbcf8e43a9afcd4556477354de20670a5365e6b1834c61c83fb2302dc
Instruction ID: 425182e27e56104c13d4950d9ffad88d39ccd68f271b872575289dba1ff06c46
Opcode Fuzzy Hash: 52171c5dbcf8e43a9afcd4556477354de20670a5365e6b1834c61c83fb2302dc
Instruction Fuzzy Hash: 6C312431B006449BEF0CAB7CDCC9B6DBB62FB86314F284618E025D77D1CB7699808792

Function 0089A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cad6a0c01290faa82f1317e86ce6e03646e3ecb33c404f2fb3de02fdb6542904
Instruction ID: f8c449541f12adc34f8476f15565c5d55b256eab505f37c7a612dcba0b72ba89
Opcode Fuzzy Hash: cad6a0c01290faa82f1317e86ce6e03646e3ecb33c404f2fb3de02fdb6542904
Instruction Fuzzy Hash: A53118317002449BEF0CABBCDCC9B6DBB62FB86310F284618E015D76D1DB7689808796

Function 0089A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8ecdf695daa0adb929db1bfcc8f87dd9fc14bab042ddc7d1f7539a548c13c534
Instruction ID: 1f67aa8aa9489a8b37e0e9247539c00640916a2c91585550d8e1e7eb3bc85b63
Opcode Fuzzy Hash: 8ecdf695daa0adb929db1bfcc8f87dd9fc14bab042ddc7d1f7539a548c13c534
Instruction Fuzzy Hash: 533107317402449BEF0CAB7CDCCDB6DBA62FB86314F284618E015DB6D5DBB589808697

Function 0089A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2800b224ad3ab2af269635da446061b65f6f9bb9a78d4618f617e3124dc31198
Instruction ID: 2cc14da240021e07584084de0f810e45956a5d73c698b7e2b93e469066f28319
Opcode Fuzzy Hash: 2800b224ad3ab2af269635da446061b65f6f9bb9a78d4618f617e3124dc31198
Instruction Fuzzy Hash: 0531D5317002449BEF0CABB8DCC9B6DBB62FB85314F284618E415DB6D5DB7589808792

Function 0089A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c0e00a018542a044240b531a84737b916655d08296283cc9cc8b1dc1364e4b31
Instruction ID: 3ae10ca0f21e3bdd6df81e3bbfc1e8bac301615f6cf54e67a78372707c16d922
Opcode Fuzzy Hash: c0e00a018542a044240b531a84737b916655d08296283cc9cc8b1dc1364e4b31
Instruction Fuzzy Hash: D13105317042449BEF0CABBCDC89B6DBB72FB86324F288618E015D76D1DB7589808692

Function 00899ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6595e4049ab675fde57af4acc658a3368d68c9ab6d26bc1073c0e5c615ffdda4
Instruction ID: c3cb3a399447afedf6906c71ee17f8ff274c6eed3d829169897b847f41cd3ba3
Opcode Fuzzy Hash: 6595e4049ab675fde57af4acc658a3368d68c9ab6d26bc1073c0e5c615ffdda4
Instruction Fuzzy Hash: 9E2134317046449BEF1CAB6CECC9B2CB762FBC5320F28461DE419D77D1DBB989808652

Function 0089A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 86dd14dd5824c2a9e0cd7575bf6f46dbc670a8082daf4115da70c1a249bca17a
Instruction ID: f706514d6cc86c2687fc4702da3ad200bdc6571255680015c7704832f3cf18c9
Opcode Fuzzy Hash: 86dd14dd5824c2a9e0cd7575bf6f46dbc670a8082daf4115da70c1a249bca17a
Instruction Fuzzy Hash: 4D21FB313552059AFF2C776C9C9AB3DB651FF81704F2C0826E508E62D1CBB9894181D3

Function 0089A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0089A963
CreateMutexA.KERNELBASE(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 65765ef94907ad7bb97b87681b4d9721d2b4e2e1b86f110465c0bc215e6ea89d
Instruction ID: 88c7935085d476805bf452da643f8f935a87a4541323a873547e2587ebdcddad
Opcode Fuzzy Hash: 65765ef94907ad7bb97b87681b4d9721d2b4e2e1b86f110465c0bc215e6ea89d
Instruction Fuzzy Hash: C9217C317002049BEF0CAB7CDC8972CBB21FBD5311F284619E415D77D1CBB695808392

Non-executed Functions

Function 00892EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00892F5F
GetCurrentThreadId.KERNEL32 ref: 00892F7E
__Mtx_unlock.LIBCPMT ref: 00892FCC
__Cnd_broadcast.LIBCPMT ref: 00892FE3
__Mtx_unlock.LIBCPMT ref: 008930F5
GetCurrentThreadId.KERNEL32 ref: 00893132
__Mtx_unlock.LIBCPMT ref: 0089319B

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 6ca599208dbca3bdc9248e7a3e7c10177743b2ec6e3365f9333b6cd1e02def57
Instruction ID: 4e469b06d3f5aa5f755f1580ee3ded66fe2ed84ea57d155e8327a36a9c9bc635
Opcode Fuzzy Hash: 6ca599208dbca3bdc9248e7a3e7c10177743b2ec6e3365f9333b6cd1e02def57
Instruction Fuzzy Hash: 45A1D270A01605EFEF21EF68C944B6AB7B8FF15314F088129E816D7651EB35EA04CBD2

Function 008CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008CCC66

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 3069cfcc83a000d5965c147e98916c6ec19df9e8b4fff4a50ddefcfb531e7577
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: C5B112329042899FDB11CF68C881FAEBBB5FF46350F1481AEE959EB241D634CD42CB61

Function 008ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 008ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABBE4
_xtime_get.LIBCPMT ref: 008ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABC13

Memory Dump Source

Source File: 00000001.00000002.1761014896.0000000000891000.00000040.00000001.01000000.00000007.sdmp, Offset: 00890000, based on PE: true

Associated: 00000001.00000002.1760980284.0000000000890000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761014896.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761070371.00000000008F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761087240.00000000008FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761105277.0000000000907000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761195418.0000000000A6A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761212230.0000000000A6C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761230597.0000000000A7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761246600.0000000000A7F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A80000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761262430.0000000000A8A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761347596.0000000000A8D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761366900.0000000000A93000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761385094.0000000000A9E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761406340.0000000000AA4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761435118.0000000000AB9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761461024.0000000000ABB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761485045.0000000000AC5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761503992.0000000000ACD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761520005.0000000000ACE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761536182.0000000000AD1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761556863.0000000000AE7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761573816.0000000000AEA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761595851.0000000000AF4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761615941.0000000000AF8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761633427.0000000000AF9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761650896.0000000000AFE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761667157.0000000000AFF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761683811.0000000000B02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761704183.0000000000B18000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761721649.0000000000B20000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761738976.0000000000B28000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761755020.0000000000B2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761781768.0000000000B57000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B59000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761798547.0000000000B64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761838378.0000000000B7C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761855714.0000000000B7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761874372.0000000000B94000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761891437.0000000000B95000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761910343.0000000000B99000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761929307.0000000000B9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761948399.0000000000BA9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1761966126.0000000000BAB000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_890000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: d6b2ce10746c6b3bfc2460c76763227f1d47aeea9a680d104387b7cf22ad0782
Instruction ID: 3094bd3952845d9b34cc0e171afd531fb37c96958872b54bb8e5342164226aac
Opcode Fuzzy Hash: d6b2ce10746c6b3bfc2460c76763227f1d47aeea9a680d104387b7cf22ad0782
Instruction Fuzzy Hash: 50211D71A00119AFEF00EBA8DC819BEB7B9FF49710F100419F601EB251DB749D419BA1

Analysis Process: 2fdda55cb5.exePID: 7352, Parent PID: 8104COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	294
Total number of Limit Nodes:	17

Executed Functions

Function 02C13D75 Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02C13FB6

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c5601e9b548c7c56f31109f917ebe28565b8114bc611d1d271313a18709ca750
Instruction ID: dba197e2e7a60b3ca8a0a27a267afa483bfdc70705d4b46ba240a190c8dea6fc
Opcode Fuzzy Hash: c5601e9b548c7c56f31109f917ebe28565b8114bc611d1d271313a18709ca750
Instruction Fuzzy Hash: 2AA1BC71D00359CFDB24CFA9C8417EDBBB2BF89314F1481A9E809A7290DB748A85CF91

Function 02C13D80 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02C13FB6

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 51af56102d90a13bbdf7d1bf0680b4b500fc5726b13a76f79dcab3002823b56b
Instruction ID: e2b8ea023c7d1445d9f83a67fe2b97fc2d16a7d3e542945c3ca7ecc2d281e747
Opcode Fuzzy Hash: 51af56102d90a13bbdf7d1bf0680b4b500fc5726b13a76f79dcab3002823b56b
Instruction Fuzzy Hash: D891AC71D00359DFDB24CFA9C8417DEBBB2BF89314F0481A9E809A7250DB749A85DF91

Function 011D8D7C Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011D8E39

Memory Dump Source

Source File: 00000008.00000002.2575324595.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11d0000_2fdda55cb5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 96294ca789390c9db4fc9d6937f7c0e600b42a5c3c009c30679c1bfcbf7d7bbb
Instruction ID: c4f0b74f20de56faf1060c812a9f97e9c5d1e0335b2750462683ea6e0aacff1b
Opcode Fuzzy Hash: 96294ca789390c9db4fc9d6937f7c0e600b42a5c3c009c30679c1bfcbf7d7bbb
Instruction Fuzzy Hash: CB41E5B1C00629DFDB24CFA9C8847CEBBB5BF44304F24806AD408AB255DB756985CF90

Function 011D7898 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 011D8E39

Memory Dump Source

Source File: 00000008.00000002.2575324595.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11d0000_2fdda55cb5.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6aef546600195032d07b9e0c820dedb12b13da9e3aa31cdac3305721318c24d0
Instruction ID: a3c94d7460a4b31bd10bfbe4c8cdf1b58dfda829ebfb3422f52099988355a447
Opcode Fuzzy Hash: 6aef546600195032d07b9e0c820dedb12b13da9e3aa31cdac3305721318c24d0
Instruction Fuzzy Hash: DD41E3B0C00729DFDB24DFAAC8447CEBBB5BF48304F24806AD408AB255DB756985CF90

Function 09F9B9D0 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09F9B9BD,?,?), ref: 09F9BA6F

Memory Dump Source

Source File: 00000008.00000002.2595852820.0000000009F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9f90000_2fdda55cb5.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 3ecc6a4369d437479df8e367456c075cc837c5210f56a7fcfdc9c4659b2a640c
Instruction ID: f284bd26cb7478e9923f517e74f143fb12d8922911664c955c42fec7f6b57250
Opcode Fuzzy Hash: 3ecc6a4369d437479df8e367456c075cc837c5210f56a7fcfdc9c4659b2a640c
Instruction Fuzzy Hash: 6C31B1B5D102499FDB10CF9AD884AEEFBF5FF58320F14842AE919A7210D775A944CFA0

Function 09F9A4EC Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,09F9B9BD,?,?), ref: 09F9BA6F

Memory Dump Source

Source File: 00000008.00000002.2595852820.0000000009F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9f90000_2fdda55cb5.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 5d2b06adbfdea57091b4450dabdce711980ddb1bc5fa6df306d27bc25e5db2e8
Instruction ID: 3f72c681fd2c354b9684071f743f73940c7a7b83e217ee9d0bbc291e995ef92e
Opcode Fuzzy Hash: 5d2b06adbfdea57091b4450dabdce711980ddb1bc5fa6df306d27bc25e5db2e8
Instruction Fuzzy Hash: D231C5B5D102499FDB10CF9AD8846EEFBF5FB58320F14842AE915A7310D775A944CFA0

Function 02C13AF0 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02C13B88

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 976e475c7904c25fd5d2d8d5c32aab93c97b02cabd6e208dea1ae72f6620e00b
Instruction ID: 352fa8f33ad318ce62aa05287aa2c6a7927f2db5f3369b491b75771fdd90932e
Opcode Fuzzy Hash: 976e475c7904c25fd5d2d8d5c32aab93c97b02cabd6e208dea1ae72f6620e00b
Instruction Fuzzy Hash: 712148B19003499FCB10DFA9C985BEEBBF5FF48324F108429E959A7250D7789945CFA0

Function 02C13AF8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02C13B88

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e787058667a81a33f860b6cc50ec9f29117208b5e12f745a046ffa587c4665c4
Instruction ID: fefa741119320fab535a28c33462eba7254d0bcfb2b28784768f6f52240994a4
Opcode Fuzzy Hash: e787058667a81a33f860b6cc50ec9f29117208b5e12f745a046ffa587c4665c4
Instruction Fuzzy Hash: 222155B1900349DFCB10DFAAC985BDEBBF5FF48324F10842AE958A7250D7789944CBA4

Function 02C13BE1 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02C13C68

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 0cf036af10809e80a569fe091e498ee219c7ba34f0cf29034b2bf58aeefb0055
Instruction ID: 16aaf9da1a2d010dc4cc3abca5608e09114527c1ea4624c3dc24b5d2868b2642
Opcode Fuzzy Hash: 0cf036af10809e80a569fe091e498ee219c7ba34f0cf29034b2bf58aeefb0055
Instruction Fuzzy Hash: 172136B29002599FDB10DFAAC985BEEFBF5FF48320F108429E558A7250C7389944CBA0

Function 02C13BE8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02C13C68

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b9d4feb500b3e5179677128ba5d947e04ec69c65445d9b666944443647aff5e5
Instruction ID: c29eb54d4fefa0893545adcf93b317801bf17f68ecdfb21dda05507c9ddc6a57
Opcode Fuzzy Hash: b9d4feb500b3e5179677128ba5d947e04ec69c65445d9b666944443647aff5e5
Instruction Fuzzy Hash: 982139B19003599FCB10DFAAC985ADEFBF5FF48320F108429E558A7250C7349544DFA4

Function 02C13960 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C139DE

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f4f068e4777892c758c6c54a0edf93144a0bc475623a03ca11af6e2679663aad
Instruction ID: af4895699a0d1943322f900b9b4cb206081f73cfc9d00c0e2654f0456780fca8
Opcode Fuzzy Hash: f4f068e4777892c758c6c54a0edf93144a0bc475623a03ca11af6e2679663aad
Instruction Fuzzy Hash: 252118B19003499FDB10DFAAC5857EEBBF4EF89324F148429D459A7244CB789944CFA4

Function 02C13959 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 02C139DE

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b2a8f4cbb4d115345be152fef56d4cc79aa1e4e738d89df6ff64c20e660d637a
Instruction ID: e67058c256b1d4de30cfe9b00fac833ddb05163772a93058ab793e2277bd3d30
Opcode Fuzzy Hash: b2a8f4cbb4d115345be152fef56d4cc79aa1e4e738d89df6ff64c20e660d637a
Instruction Fuzzy Hash: 9E213A719002498FDB10CFAAC5857EEFBF4EF88314F14842AD459A7354C7789944CF90

Function 0B4B7B8F Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0B4B7C03

Memory Dump Source

Source File: 00000008.00000002.2596709699.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b4b0000_2fdda55cb5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a659e2e727e17f7f105e2ef0dae67fbe116621b68db6f25c6c594c38f1776d99
Instruction ID: 0cdc07a94bfbd0e98ef2683df91aed2e18df50e8f0902591a59dc65a5b601f3c
Opcode Fuzzy Hash: a659e2e727e17f7f105e2ef0dae67fbe116621b68db6f25c6c594c38f1776d99
Instruction Fuzzy Hash: C12117B5900249DFCB10CF9AD444BDEFBF4FB48320F10842AE558A7250D374AA84CFA5

Function 09F9A55C Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09F9C6EA,?,?,?,?,?), ref: 09F9C78F

Memory Dump Source

Source File: 00000008.00000002.2595852820.0000000009F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9f90000_2fdda55cb5.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 0ca2604a14affd2cfe2a08e71ce1a73da407234996ea37169604edce41041ca0
Instruction ID: 2f4f4301e074771514c20c65016387529fed0f8b346abb1c4ce06e9f6dd26dc0
Opcode Fuzzy Hash: 0ca2604a14affd2cfe2a08e71ce1a73da407234996ea37169604edce41041ca0
Instruction Fuzzy Hash: 1F114CB5800359DFDB10CF99C844BDEBFF8EB48320F14841AE554A7210C375A954DFA5

Function 0B4B7B90 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0B4B7C03

Memory Dump Source

Source File: 00000008.00000002.2596709699.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b4b0000_2fdda55cb5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1f7f7ba37a8cb2be9c5ede39f4828ed042bf13d66a2bcc0a1b1fe79284097496
Instruction ID: 68b66e0849ce2a3c1b3474340371245a3df7a2fc03da5bdf45f2f2166de5bf12
Opcode Fuzzy Hash: 1f7f7ba37a8cb2be9c5ede39f4828ed042bf13d66a2bcc0a1b1fe79284097496
Instruction Fuzzy Hash: 9A21E7B5900249DFCB10DF9AD544BDEFBF4FB48320F10842AE558A7251D374AA44CFA5

Function 02C13A30 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02C13AA6

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 45c858f30b5f2e1471a48dd0a79ed4486c9c27c55c64e433926985bd4c0b3251
Instruction ID: fa79bd2c93e774f9185a6876f6ecf260c95093a0bff22a91c3e004eab9bb49b4
Opcode Fuzzy Hash: 45c858f30b5f2e1471a48dd0a79ed4486c9c27c55c64e433926985bd4c0b3251
Instruction Fuzzy Hash: 9F1156B29002489FCB20DFA9C845AEEBFF5EF88324F248819E455A7250C7759945CFA0

Function 09F9C71F Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,09F9C6EA,?,?,?,?,?), ref: 09F9C78F

Memory Dump Source

Source File: 00000008.00000002.2595852820.0000000009F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9f90000_2fdda55cb5.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 5120a9208ce157a36babac8534de19d42d3670ec5e932637e32a48c77204c1c7
Instruction ID: ec97d46fa9decc8d8d4ad158518005d283656d0827c12145fd582f0233a7d0dc
Opcode Fuzzy Hash: 5120a9208ce157a36babac8534de19d42d3670ec5e932637e32a48c77204c1c7
Instruction Fuzzy Hash: 361119B58002599FDB10CFAAD844BDEBFF8EB48320F14841AE554A7250C375A994DFA5

Function 02C13A38 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02C13AA6

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3e8355c34e35d4e34ad198041509947d6ce7659cf734956ccf2a87edac156d8c
Instruction ID: 947265b3f4d63a3d1260053740b076d68a1070406799ae6c3a66b1b40652f460
Opcode Fuzzy Hash: 3e8355c34e35d4e34ad198041509947d6ce7659cf734956ccf2a87edac156d8c
Instruction Fuzzy Hash: 6A1137729002499FCB10DFAAC845BDFBFF9EF88324F108819E555A7250C775A944CFA0

Function 02C138A8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 02C13912

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 01d79775ad48a358400200e57e3b45d4fa1f6b6ff5b29134b2a4112cfb253128
Instruction ID: d4b8062f03de1e0eec15805117c0c8bc52d922c4a370e1298b478c907a49428e
Opcode Fuzzy Hash: 01d79775ad48a358400200e57e3b45d4fa1f6b6ff5b29134b2a4112cfb253128
Instruction Fuzzy Hash: 7E1158B1D002888FCB20DFAAC4457EEFFF5EB88324F24842AD459A7250C735A945CF94

Function 02C138B0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 02C13912

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 252d50ed714ea0ed6f12a5296ba33bd59c3b1a406daf4dabea4690bbe4c61490
Instruction ID: 1ce8ae801fe75b459caa733f5cd2e1b457842bfb8ef6054c08c3485a127c7824
Opcode Fuzzy Hash: 252d50ed714ea0ed6f12a5296ba33bd59c3b1a406daf4dabea4690bbe4c61490
Instruction Fuzzy Hash: 90113AB19003488FCB10DFAAC4457DEFBF8EB88324F208419D459A7254C775A544CFA4

Function 011DE560 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 011DE5C6

Memory Dump Source

Source File: 00000008.00000002.2575324595.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_11d0000_2fdda55cb5.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 573eb61166771c743657776835151a072e9a2b562b583a0ad440edd5a05afd3e
Instruction ID: 3c08aff31ad8d8f2bbf9442dd107ede31aff3e3d4598194677f49888fef11440
Opcode Fuzzy Hash: 573eb61166771c743657776835151a072e9a2b562b583a0ad440edd5a05afd3e
Instruction Fuzzy Hash: 401110B6C003498FDB14CF9AC444ADEFBF4AB88320F10846AD468B7210D375A545CFA1

Function 02C105F4 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02C1628D

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 21abe8ed4f9dfc9987e0a49e48c403c1def6af45b92f12625ee98e914977ea77
Instruction ID: 36b0c3bf0cdf4bfd2bfeb0c7c17739aaaccc3aa0577509822ed46ee3d1089c8a
Opcode Fuzzy Hash: 21abe8ed4f9dfc9987e0a49e48c403c1def6af45b92f12625ee98e914977ea77
Instruction Fuzzy Hash: 5911F2B58003489FCB10DF9AC885BDEBBF8EB49320F208459E558A7300C3B5A984CFA5

Function 02C1622A Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 02C1628D

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 293d480fe3789650e9710d37c61cf21b2a4f3892ee6fb8441a14af492da0a2a9
Instruction ID: c26cc41e0351ae8240002e7368b73cec1a63bb4c76bc01368f0d3218442f9358
Opcode Fuzzy Hash: 293d480fe3789650e9710d37c61cf21b2a4f3892ee6fb8441a14af492da0a2a9
Instruction Fuzzy Hash: E01103B58002489FCB10CF99D585BEEFFF8EB58324F208459E558A7300C375A984CFA0

Function 0116D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2572982389.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_116d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20fc9d94a5360e84ace29ec8dc524c4ff6d286c2ac6ff78bb26b1319d4f1f7f
Instruction ID: 93f0b82398eef43fd15af33adb1f270ab1e12a1a906ef85b97c64b867f2d7f1c
Opcode Fuzzy Hash: d20fc9d94a5360e84ace29ec8dc524c4ff6d286c2ac6ff78bb26b1319d4f1f7f
Instruction Fuzzy Hash: 7E212571600240DFDF09DF58E9C0B26BF79FB88318F24C569E9894B656C337D466CAA2

Function 0117D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2573048664.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_117d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b3ae36980e532d2ef97fe60bf0dec0714b61e157b5163e77617e2604df822eb
Instruction ID: d187b21f943ef056c0266824652f43dada071955fc4e25a88604ca0f4c73e9fa
Opcode Fuzzy Hash: 3b3ae36980e532d2ef97fe60bf0dec0714b61e157b5163e77617e2604df822eb
Instruction Fuzzy Hash: 3E21D371644208DFDF09DF98E580B26BBB5FF84324F24C56DE9494B356C336D446CA62

Function 0117D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2573048664.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_117d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52e14104b2f5de31017a0ec613025f148f74b2b57df155f3709efd3170a7edb
Instruction ID: 74ddeea21b29ccdc29ee3c633c88ff866cf9656c44c7023947a2cc061818e77a
Opcode Fuzzy Hash: d52e14104b2f5de31017a0ec613025f148f74b2b57df155f3709efd3170a7edb
Instruction Fuzzy Hash: 48210071604208DFCF1ADF58E984B26BBB5EF88314F20C56DD80A4B356C33AD446CA62

Function 0117D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2573048664.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_117d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3405bb572ff0492d07265cced3d444e2f338e87f9e8f9637d989612aaacbc22b
Instruction ID: af3fa37d25840fc325edff0a7a46a104e6d391e524de78b1e5a1ec60984189a0
Opcode Fuzzy Hash: 3405bb572ff0492d07265cced3d444e2f338e87f9e8f9637d989612aaacbc22b
Instruction Fuzzy Hash: 0521DE355083848FCB07CF24D990B15BF71EF46214F28C1EAD8498F2A3C33A980ACB62

Function 0116D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2572982389.000000000116D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0116D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_116d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3a7453609dbb31cebc72fe139aec69a7d50158afd582b550f6a27f983270e1f8
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: C511B176504280CFDF16CF54E5C4B16BF71FB84318F24C6AAD9490B656C336D46ACBA2

Function 0117D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2573048664.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_117d000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: f854f79de10ebd8d6bd352dee163efa89ec0fe42016407f608099c9570fa5b2e
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: F411A975504284DFDB06CF54D5C4B15BFB1FB84224F28C6AAD8494B396C33AD40ACB62

Non-executed Functions

Function 02C15193 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f46bcbf13f4b0c607f1026d076e6c98313e7bafe7fd536353eaf5a7c0c4d9b
Instruction ID: d1c8661363892fc18bb8bf2e32e935c1ff48c1880565f0d5bef4d9695f9939db
Opcode Fuzzy Hash: 28f46bcbf13f4b0c607f1026d076e6c98313e7bafe7fd536353eaf5a7c0c4d9b
Instruction Fuzzy Hash: B4E0B675A89148CBCB50CF95F8866F8B7B8EB8F351F4020A1D50EA3261DB309994DB00

Function 02C1516B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2577674425.0000000002C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c10000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a316bd3fe847b0983ae345535517cbf0de62a997526e6331a6d81302065be47
Instruction ID: 9017eee9943f43a040178cef26580855a151387e9f79d4a64f23319ba7a5af86
Opcode Fuzzy Hash: 0a316bd3fe847b0983ae345535517cbf0de62a997526e6331a6d81302065be47
Instruction Fuzzy Hash: 53D0A776ECE104DBC7000AA5B8562F9B33CDFC7052F042061D50E93109D320C034D514

Analysis Process: 2fdda55cb5.exePID: 3848, Parent PID: 7352COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	3

Executed Functions

Function 059617D0 Relevance: 16.1, Strings: 12, Instructions: 1142COMMON

Download Yara Rule

Strings

,oq, xrefs: 0596229A
$kq, xrefs: 05961A73
$kq, xrefs: 0596211A
$kq, xrefs: 05961CE7
$kq, xrefs: 05961C37
$kq, xrefs: 05961C27
$kq, xrefs: 059620B1
$kq, xrefs: 05961CD7
4, xrefs: 059621B5
$kq, xrefs: 059620C1
$kq, xrefs: 0596210A
$kq, xrefs: 05961A63

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: ,oq$4$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1127353760
Opcode ID: 15f898c00908d26324577e5b98df2c6a92d8c8e7260d6db618b049630859c96b
Instruction ID: db6fa164ca65a465d786c2f283d7d0e549e4d8daed9814e471c61c19643d034f
Opcode Fuzzy Hash: 15f898c00908d26324577e5b98df2c6a92d8c8e7260d6db618b049630859c96b
Instruction Fuzzy Hash: C6B2F934A00218CFDB14CF99C994BADB7B6FF48300F1585A9E506AB2A5CB75ED85CF50

Function 05961B07 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

,oq, xrefs: 0596229A
$kq, xrefs: 05961C27
$kq, xrefs: 059620B1
$kq, xrefs: 05961CD7
4, xrefs: 059621B5
$kq, xrefs: 0596210A

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: ,oq$4$$kq$$kq$$kq$$kq
API String ID: 0-569362799
Opcode ID: a3af0baca3b19849b235228a6d5e32a73a4f9206b4d51a1dfe234db02a1edf97
Instruction ID: 80c04fdfa5b011287c7908a3438ac9da86e89f7fd25c17eac50036955baddaf4
Opcode Fuzzy Hash: a3af0baca3b19849b235228a6d5e32a73a4f9206b4d51a1dfe234db02a1edf97
Instruction Fuzzy Hash: 20220D34A00218CFDB24DF64C994BADB7B6FF48304F1580A9E50AAB3A5DB71AD85CF50

Function 059899F8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70b8d105cab5d625542c7b7c48e5a15dd1b1f372c4ebe683daade15c1f1c559
Instruction ID: 2f1ff690da77f3a4823f2b561643ae17d2729f45274f43a27cfc8352c220c56f
Opcode Fuzzy Hash: e70b8d105cab5d625542c7b7c48e5a15dd1b1f372c4ebe683daade15c1f1c559
Instruction Fuzzy Hash: F991A930B04205CFDB14EF59E558BBAB7F7FB89314F5881A5E406AB298D778AC81CB44

Function 05984990 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a441e2dda36e1c6243d2b4c9b6b282e801111338480efb98af726e76fd073764
Instruction ID: cdea70c3a5e06a287bb450c628df6e3f9456f77720fc89c95836a7463875d329
Opcode Fuzzy Hash: a441e2dda36e1c6243d2b4c9b6b282e801111338480efb98af726e76fd073764
Instruction Fuzzy Hash: DD518F70A0020ACFCF84EFA9D454AAEB7F2FF48314F4184A9D016AB2A0DB756945CF11

Function 059849A0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55990fc7a501e6f8a9fda83942995ad7c916edceae3a7342e75eb2ebf14643e0
Instruction ID: b3156a806bba0afec2340d6c7b892bd1bd8ecc39d5dbc17b2bdc9ad255b9866f
Opcode Fuzzy Hash: 55990fc7a501e6f8a9fda83942995ad7c916edceae3a7342e75eb2ebf14643e0
Instruction Fuzzy Hash: 97518070A0020ACFCF84EFA9D454AAEB7F2FF48314F4184A9D026AB290DB756D45CF15

Function 05969208 Relevance: 7.9, Strings: 6, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 05969352
4'kq, xrefs: 059692BC
poq, xrefs: 0596935F
(oq, xrefs: 059693D2
4'kq, xrefs: 059692DA
4'kq, xrefs: 0596928C

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$4'kq$4'kq$4'kq$4'kq$poq
API String ID: 0-755401861
Opcode ID: e4dca7f8cdebab7101b87d8de8c9bba6be7e8060f4d7467d8aea3cf5767a4289
Instruction ID: ad2ac5757141e48b79b0a3ec4b873b3c9fe0f79dd62775cff47db84516dcffe7
Opcode Fuzzy Hash: e4dca7f8cdebab7101b87d8de8c9bba6be7e8060f4d7467d8aea3cf5767a4289
Instruction Fuzzy Hash: 5ED15D32A00215DFCB05CF64D944EAABBB7FF88310F5584A8E509AB271D732ED55DB90

Function 05967F40 Relevance: 4.2, Strings: 3, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 05968494
Hoq, xrefs: 05968415
Hoq, xrefs: 05968444

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Hoq$Hoq$Hoq
API String ID: 0-3310881576
Opcode ID: 41ad6d159b4336c1bd215adb3393526432e9ba35e4caa243b7788704ec5ae30f
Instruction ID: dab25328796044b0c806d2d530dd722d57b8036cc89920078598e1efd8373cb5
Opcode Fuzzy Hash: 41ad6d159b4336c1bd215adb3393526432e9ba35e4caa243b7788704ec5ae30f
Instruction Fuzzy Hash: 28125C30A002058FCB65DFA5D584A6EBBF6FF88300F54892DD506AB3A4DB35EC4ACB50

Function 05969C00 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 05969E1A
4'kq, xrefs: 05969F79
4'kq, xrefs: 05969EF9

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq
API String ID: 0-2478202913
Opcode ID: b4f267c378528de15bd0296b7b2c8a5f1aa15a1a95bc79a503d5cd4e4bdf3221
Instruction ID: 9cd6725996f274e18da1339a21c6420580012083b0a5f50e719e2c8b1afa63af
Opcode Fuzzy Hash: b4f267c378528de15bd0296b7b2c8a5f1aa15a1a95bc79a503d5cd4e4bdf3221
Instruction Fuzzy Hash: 1BF1CC34B10218DFCB18DF64D998A9DBBB2FF89301F558158E806AB3A5DB75EC46CB40

Function 0596E030 Relevance: 4.1, Strings: 3, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 0596E1C1
(oq, xrefs: 0596E195
(oq, xrefs: 0596E169

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$(oq$Hoq
API String ID: 0-3836682603
Opcode ID: c9b8bf2d695a6829baea587af6f561b242c58a600b97a1472b84aab86acce28b
Instruction ID: ddd9a8bdc4f8fafc6e50bacf130b0ada6af9e100f8be22766c112769821c45ed
Opcode Fuzzy Hash: c9b8bf2d695a6829baea587af6f561b242c58a600b97a1472b84aab86acce28b
Instruction Fuzzy Hash: 7FE10C34B00219DFCB14EF64D5949AEBBB6FFC9310F518569E806AB364DB30AD49CB90

Function 057D0B28 Relevance: 3.9, Strings: 2, Instructions: 1383COMMON

Download Yara Rule

Strings

4'kq, xrefs: 057D1CDE
4'kq, xrefs: 057D1CEA

Memory Dump Source

Source File: 0000000A.00000002.2596056944.00000000057D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57d0000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 46f77496f2b50b5271be86c0bfdb8c10bfb377e9618028f24e89fd4e4a5fdf0a
Instruction ID: ab8b934872b49532ea5dffdd1ea0c219a2b4326fccc13013451761d328d8eb51
Opcode Fuzzy Hash: 46f77496f2b50b5271be86c0bfdb8c10bfb377e9618028f24e89fd4e4a5fdf0a
Instruction Fuzzy Hash: 1AA2BF30F042298F8B705A69555863EADF7BBC8741B94842ADE07D7358EE31CC85E7B2

Function 059798B3 Relevance: 3.5, APIs: 2, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 05979C9E
GetSystemMetrics.USER32(00000001), ref: 05979CD8

Memory Dump Source

Source File: 0000000A.00000002.2597886428.0000000005970000.00000040.00000800.00020000.00000000.sdmp, Offset: 05970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5970000_2fdda55cb5.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: ec220b8c53bb3e58d38c5326d652121e907d6e02a01fe050655df1c5d0b81348
Instruction ID: 44dc2dcc6f6e5356769709098d49fda305c70806bee7b9056bcc61dd250fd0c9
Opcode Fuzzy Hash: ec220b8c53bb3e58d38c5326d652121e907d6e02a01fe050655df1c5d0b81348
Instruction Fuzzy Hash: 872124B1D043498FDB10DF99C8497DEBFF8EB08314F28845AD45AAB390C779A584CBA1

Function 059638F9 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 05963C13
$kq, xrefs: 05963C23

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: a25b09f3a3ab756d5fdb70dc6cb6ca875982e339223919985426b3dc1e9f5d01
Instruction ID: 55435f1611ebefcc82447b6dcc1b85a2ca1b3984309bca2d5f5cecd16cad0cfb
Opcode Fuzzy Hash: a25b09f3a3ab756d5fdb70dc6cb6ca875982e339223919985426b3dc1e9f5d01
Instruction Fuzzy Hash: BF123A34A00219CFCB15CFA9D958ABDBBB6FF48710F148455E802A7394DB79AD4ACB60

Function 059679F8 Relevance: 2.8, Strings: 2, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 05967C59
(oq, xrefs: 05967A0C

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$d
API String ID: 0-886291620
Opcode ID: 128a3676760acdce65a5af31b934c0db91900afa658ded1eec18990ea29856d8
Instruction ID: 32da8e87cb3d5697b752e745b29dbc6bea5ad3991414ec9c4d7000accc103d82
Opcode Fuzzy Hash: 128a3676760acdce65a5af31b934c0db91900afa658ded1eec18990ea29856d8
Instruction Fuzzy Hash: AFD17B34600602CFCB14CF68C59096AB7F6FF88314B56C969E85A9B365DB34FC4ACB90

Function 05968780 Relevance: 2.8, Strings: 2, Instructions: 325
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hoq, xrefs: 05968A2C
Hoq, xrefs: 05968A94

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: 08098dd5c22916d58fc15e3582db9b35afcd0cc7a055d7c332f193d3abaefb54
Instruction ID: 47873e04882e3a7b44bb547bf9bd4f653452b7adce9e290c68f8fa12c6bef3ef
Opcode Fuzzy Hash: 08098dd5c22916d58fc15e3582db9b35afcd0cc7a055d7c332f193d3abaefb54
Instruction Fuzzy Hash: 9CC19D307005069FCB04DF69C484A6EBBFAFF88314F558568E8199B3A5DB34EC4ACB95

Function 0596FA20 Relevance: 2.8, Strings: 2, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 0596FD00
4'kq, xrefs: 0596FCD2

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 354d4c54304641f703cd9dba21f02684b1d9c5bc4414931e5828a685de4b7975
Instruction ID: fafd0a5600f0deb3ef543298fd4b1a1cce7547de8ce3f7fe0b3db9d04436b3c3
Opcode Fuzzy Hash: 354d4c54304641f703cd9dba21f02684b1d9c5bc4414931e5828a685de4b7975
Instruction Fuzzy Hash: CFC1B874B40218DFCB04EFA8C994AADB7B6FF89300F514169E506AB3A4DB71EC46CB50

Function 0596FA10 Relevance: 2.8, Strings: 2, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 0596FD00
4'kq, xrefs: 0596FCD2

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 65aba2019b7eef28e867e72859705861f11af4a92fd5e4ff6dcd0a9e5b713616
Instruction ID: a448eb9a8c56944f9a4b167f02bddc70babeff59f43d4c93502d6e6df50c7eb3
Opcode Fuzzy Hash: 65aba2019b7eef28e867e72859705861f11af4a92fd5e4ff6dcd0a9e5b713616
Instruction Fuzzy Hash: 1DB1CC74B00218DFCB04EFA4C998AADB7B6FF89304F514169E506AB3A5DB71EC46CB50

Function 05962E68 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 05962F6E
Hoq, xrefs: 05962FFD

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: f0bb8cda692d556f0e00138854e9a046d088528f9afd0cbe62daac1b432bfe84
Instruction ID: f84c55b8096ed44af3b8333c11e4964e940af6bfa77f076ada56a8838dbc5645
Opcode Fuzzy Hash: f0bb8cda692d556f0e00138854e9a046d088528f9afd0cbe62daac1b432bfe84
Instruction Fuzzy Hash: 575159347002058FCB59AF39C45452E7BBAFFD9200760856DE9069B3A5CF35EC0ACB91

Function 0598F790 Relevance: 2.6, Strings: 2, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 0598F8B8
Hoq, xrefs: 0598F8E4

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 851ef0ffb2b08275ce6b7a36eb08d966dddc7554802c5e679467e608c78885fc
Instruction ID: 768a464d25b62ab8943f4342f6345947661b45cf3cbe15b06d48a6e1231fd8d8
Opcode Fuzzy Hash: 851ef0ffb2b08275ce6b7a36eb08d966dddc7554802c5e679467e608c78885fc
Instruction Fuzzy Hash: 1341BC316047018FD725EF2AC44432ABBE6FF84310F508A29D4568B7A5EB78EC89CB91

Function 059691E3 Relevance: 2.6, Strings: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

poq, xrefs: 0596935F
4'kq, xrefs: 0596928C

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq$poq
API String ID: 0-937253537
Opcode ID: 2e33245cadc5ec115c1c199b71e09653eecbf441642229efd0f23c2e465b0891
Instruction ID: ff36db3ab4d30e7f0b1fa2f233f5a66ddf40b175b9f0176d8acda8119dc0430b
Opcode Fuzzy Hash: 2e33245cadc5ec115c1c199b71e09653eecbf441642229efd0f23c2e465b0891
Instruction Fuzzy Hash: CC41B171A403059FC755DB68C9807AFBBF7FF88300F548928C4059B3A9DB75AD4A87A0

Function 0596B8E8 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

Hoq, xrefs: 0596B963
(oq, xrefs: 0596B937

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 1e61efdcaa5f9e5d21e3d07de70cdd231f6b677b14b94c8db0c1e77406cdc6b7
Instruction ID: 3107971deaa0eb893be9ba48f56df3a56af712eb6e5b601cf3586c8370485f3c
Opcode Fuzzy Hash: 1e61efdcaa5f9e5d21e3d07de70cdd231f6b677b14b94c8db0c1e77406cdc6b7
Instruction Fuzzy Hash: C821F3313081444FC705AB79D880A6EBFB6FFC5340B6481AAE505DB3A5DE349D0983C2

Function 05964480 Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

(_kq, xrefs: 05964710

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (_kq
API String ID: 0-2183774854
Opcode ID: 41e5b8721bac11cc6c1c54c359f146eeb5bcb57669ae00fa43678bd14b67a4e6
Instruction ID: b469bbeb0dccc1f20f5c0b4cbf8a97c6497ac23385f743d117ed9f6abadd281b
Opcode Fuzzy Hash: 41e5b8721bac11cc6c1c54c359f146eeb5bcb57669ae00fa43678bd14b67a4e6
Instruction Fuzzy Hash: 73226B35A002059FCB14DFA8D494A6EBBF6FF88314F548069E90ADB3A5DB75EC44CB50

Function 0596B10C Relevance: 1.6, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

,oq, xrefs: 0596AE59

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: db4093559e45ed604e6b16d2812e68925b856237ca0f0b81e33a18e064005aba
Instruction ID: e9c3d2905178bbac17e0b7ed1cf7e29fe8892bd4325d5158f51fcca7dfcf3660
Opcode Fuzzy Hash: db4093559e45ed604e6b16d2812e68925b856237ca0f0b81e33a18e064005aba
Instruction Fuzzy Hash: 17E1C375A002288FCB64CF69C981BDDBBF2BB88300F5545D9E549E7361DA309E85CF61

Function 01809FB0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0180A024

Memory Dump Source

Source File: 0000000A.00000002.2590207610.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1800000_2fdda55cb5.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 72011c5d01058e70adee07b184bf7b8c3df70a0103e02c22b1d6f11513dd7805
Instruction ID: 5e8aad45cafd8b421f5bd360e25981d704a78457fcfd0cfedf6d18a6da26d15f
Opcode Fuzzy Hash: 72011c5d01058e70adee07b184bf7b8c3df70a0103e02c22b1d6f11513dd7805
Instruction Fuzzy Hash: 0711F4B1D003499FDB14DFAAC884ADEFBF8EF48320F10842AD559A7250C779A944CFA0

Function 0596E5C8 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

(oq, xrefs: 0596E87C

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: e38d3347b724a019c7c7f9cb2e3870c919da8881c124be933b8da392a50707e5
Instruction ID: 3486747a933c45d8d5efa6a7b7c6cdc5f0d876de75e2a178a22c84bc6ce52c7d
Opcode Fuzzy Hash: e38d3347b724a019c7c7f9cb2e3870c919da8881c124be933b8da392a50707e5
Instruction Fuzzy Hash: 2BA17E353042009FD7199F68D954E2A7BB7FF89310F1984A9E6068F3A2CB36EC56DB41

Function 05984BE1 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Drq, xrefs: 05984C85

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Drq
API String ID: 0-1024708742
Opcode ID: f57e0bc595338fed53811354782e13e5bdf4e4d8f9fb9ea1d03f3ce762dfe8b8
Instruction ID: 66a898680d7b47d94567de6db8cd8afad2b0fb1e4d683b3952826216dbaa96e8
Opcode Fuzzy Hash: f57e0bc595338fed53811354782e13e5bdf4e4d8f9fb9ea1d03f3ce762dfe8b8
Instruction Fuzzy Hash: C4A1BD307002058FCB14EF28D954A6ABBF6FF88714F558569E40AEB3A1DB70EC41CB90

Function 05964C08 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

Plkq, xrefs: 05964DF0

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Plkq
API String ID: 0-177148220
Opcode ID: 561d156cb2ab69b28fd2ea39022ae345104f24270654bfe41fb055a57bfa67c1
Instruction ID: 3d6ffd8e01bce15bf5ca9b3e2a8ba370f0157c1ada3a8278d20355b6c3a3d771
Opcode Fuzzy Hash: 561d156cb2ab69b28fd2ea39022ae345104f24270654bfe41fb055a57bfa67c1
Instruction Fuzzy Hash: 31913430B402188FCB15DF68C594AAA7BFABF89710F1084A9E506CB3B5DB75EC45CB91

Function 05969BF3 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

4'kq, xrefs: 05969E1A

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 0bee7dc7f22d959d6a81f3d8e09ecb6cd096b83a33859c8464da00d42d9d173d
Instruction ID: 1d63f0e4aceea6cb6eae90683e6e486cfac20afb2f9ef7893b7318af566916e5
Opcode Fuzzy Hash: 0bee7dc7f22d959d6a81f3d8e09ecb6cd096b83a33859c8464da00d42d9d173d
Instruction Fuzzy Hash: CBA1EC34B10218DFCB14DFA4D998A9DBBB2FF89300F558169E806AB365DB71EC46CB40

Function 05984BF0 Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

Drq, xrefs: 05984C85

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Drq
API String ID: 0-1024708742
Opcode ID: 1aa1d74650a600e8c6bc7103320321d42b17b98bc81c9f3e5e073273a2feeb67
Instruction ID: 3c03645e71b5f041c7f33286496a328bec799bc9a76ec6ee509df073d04ee79d
Opcode Fuzzy Hash: 1aa1d74650a600e8c6bc7103320321d42b17b98bc81c9f3e5e073273a2feeb67
Instruction Fuzzy Hash: 39616B346006068FCB14EF29D584D6ABBF6FF88314B558569D41AEB3A1DB70EC41CF90

Function 0598ED80 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

poq, xrefs: 0598EE30

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 8568a2ba4e942c9700148534758a7abb9a2813d9ae86992eacdd7dd5abc99c0c
Instruction ID: 3c4b8b4d181f9928aae7345740198c60afb8a6c8a0353cc8e569e6a28b35cf20
Opcode Fuzzy Hash: 8568a2ba4e942c9700148534758a7abb9a2813d9ae86992eacdd7dd5abc99c0c
Instruction Fuzzy Hash: 8B514C76640100AFCB459FA8D915D29BBF7FF8C31471980E8E2099B372CA36DC22DB50

Function 0598A139 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

Tekq, xrefs: 0598A1BB

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 30f5d4d4549ee320b4056ba8030f6291cb8be88ba298392a6670fe17f14ed70a
Instruction ID: afeee074021c9e02b51a0a36a0d3a2f9e0dfe6a93450bedb1826d8081e8d30f2
Opcode Fuzzy Hash: 30f5d4d4549ee320b4056ba8030f6291cb8be88ba298392a6670fe17f14ed70a
Instruction Fuzzy Hash: B551AF30704105CFDB14EB19E558BBA77E7FBC8720F5940ABD0069BAA4CBB9AC85CB45

Function 0596D704 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0596D74A

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 640034ab01740424f8af4e9f4d7a7ef9f3e3dbeb50b743d142f14c5f2c24c628
Instruction ID: 3f0064686d924f9bbb6e737f14098942538a0644677d5cbe0b9d635e18dd58ec
Opcode Fuzzy Hash: 640034ab01740424f8af4e9f4d7a7ef9f3e3dbeb50b743d142f14c5f2c24c628
Instruction Fuzzy Hash: 8E415234B106148FCB14EF64C498AAEB7B7BFC8704F544429E406AB3A4DF74AC4ACB91

Function 0598FD90 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

(oq, xrefs: 0598FDA4

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 919122a731a4ff1fec7fcc44d1eeaa1d4ee9ed630c80b59b8be9dff1a2c5082a
Instruction ID: 9780dc55c39f27488eee770755ac46900f8ef22022a44cdb9a1ad2aa513b935c
Opcode Fuzzy Hash: 919122a731a4ff1fec7fcc44d1eeaa1d4ee9ed630c80b59b8be9dff1a2c5082a
Instruction Fuzzy Hash: A0417C35B005168FCB10DF18C484A7AFBB5FF89320B559699E92A9B352D730F852CB90

Function 057D0AD8 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

4'kq, xrefs: 057D1CDE

Memory Dump Source

Source File: 0000000A.00000002.2596056944.00000000057D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57d0000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: f1e2e72ea2e481411cd827026c3cdc4936258341f827bb3709c523c1e0779a2d
Instruction ID: 4fc413f942b256d1e3255ed199479d4876359b7e1c0b6b0e6acd0d03a021dfed
Opcode Fuzzy Hash: f1e2e72ea2e481411cd827026c3cdc4936258341f827bb3709c523c1e0779a2d
Instruction Fuzzy Hash: 0B216B72E0D3558FC7128B648C196ADFFB1FF82315F0505DAD8819B2D2E7345846DBA1

Function 0596907B Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

4'kq, xrefs: 059690C1

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 846d19000a61c9a6eaa093e55c3f54b5ca9ee3b557c808d1f8ae7809faf2a474
Instruction ID: bdf777acd3dd2abf79877380b5d437ea250715f911147c94ccc03bb2de783c3a
Opcode Fuzzy Hash: 846d19000a61c9a6eaa093e55c3f54b5ca9ee3b557c808d1f8ae7809faf2a474
Instruction Fuzzy Hash: 2D219E35B001049FCF189FA4C95895D7FB6FF88311F1584A9EA06AB3B1CA72EC4ACB51

Function 059637D0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<kq, xrefs: 0596381A

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: p<kq
API String ID: 0-3321991346
Opcode ID: 076f18b7f2aa79e855513025bb9bcefc870bc4a064917e85e6a427dde65e85e0
Instruction ID: 6244dd6bffccfcd0ce43581c6dfc0c9666e599be85caed21ad82564bc3711ce9
Opcode Fuzzy Hash: 076f18b7f2aa79e855513025bb9bcefc870bc4a064917e85e6a427dde65e85e0
Instruction Fuzzy Hash: 4B213871704258AFCB15CF2AD844AAA7BEAFF89210B158466F805CB3B0DB39DC51CB60

Function 059637E0 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<kq, xrefs: 0596381A

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: p<kq
API String ID: 0-3321991346
Opcode ID: 3b8ddba5baf8d506680061c4f52250713c23df61c8e47b7c1596c75380976d9f
Instruction ID: 60f14b75c08762b35782d56ed900c23617399d2379bd256f3a8e73643eca1963
Opcode Fuzzy Hash: 3b8ddba5baf8d506680061c4f52250713c23df61c8e47b7c1596c75380976d9f
Instruction Fuzzy Hash: 29215B303042599FCB15CF2AC844AAA7BEABF89210B1984A5FC45CB3A1CB39DC51CB60

Function 0180A160 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 0180A1C2

Memory Dump Source

Source File: 0000000A.00000002.2590207610.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1800000_2fdda55cb5.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5d7807ae01e7531a672cbf8d8f7dc835d1794348a87086af3eaf7111df27fb01
Instruction ID: 8ecb78d8b8570a851caabc09c74be48cdf5c701efecbd3f2e11722c8f743ccf9
Opcode Fuzzy Hash: 5d7807ae01e7531a672cbf8d8f7dc835d1794348a87086af3eaf7111df27fb01
Instruction Fuzzy Hash: 55113AB1D003488FDB14DFAAC8457DEFBF4EB88324F208419D559A7250C779A944CF94

Function 05E638B9 Relevance: .8, Instructions: 843COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f4ef287c21d9f509b49f3ae7f97f0306031703336b94470b8475a29cd382f0
Instruction ID: 49e9f8bc037a17cea511c3cdee1493a04e6f7a185fda3d5fd53c1c7a47eb8dea
Opcode Fuzzy Hash: 32f4ef287c21d9f509b49f3ae7f97f0306031703336b94470b8475a29cd382f0
Instruction Fuzzy Hash: 84623030A94129DFCB94DF29D89569DBBB1FF86304F9148E9D90EAB250DE302E84CF54

Function 0596D950 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a6ebff37be67954b59bf12c9eef317c246434c5a106d06da3d872b10c67d5f
Instruction ID: 45434834de605eee90b08ea9c07bd158e93faa89b58a9d917727b3b06b2fd976
Opcode Fuzzy Hash: c3a6ebff37be67954b59bf12c9eef317c246434c5a106d06da3d872b10c67d5f
Instruction Fuzzy Hash: 4212FA34B102198FCB14EF64C994A9DBBB2BF89300F5185A8E54AAB355DF31ED89CF40

Function 05965909 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca813ec9a4d90e96c627cb19d73eab66a8a4031a59ee705efacfc3a4bac92b83
Instruction ID: 04d430e9683b75afec4e62424beb6d1cecf7e0d8aeffe8cdd51b5a025b102b6c
Opcode Fuzzy Hash: ca813ec9a4d90e96c627cb19d73eab66a8a4031a59ee705efacfc3a4bac92b83
Instruction Fuzzy Hash: DA912635A402188FCB14DF68C584A9EBBFAFF49310F5685A9E806DB361DB30EC45CB90

Function 0596D940 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7e216771cf5ddb39044721310be721eb3c3e7965cc92aebc43f8e73964297b
Instruction ID: 522a2bf935ffec9ef4d2b0ffe903df79c75ba93bd5536f327918d2b9c5407aea
Opcode Fuzzy Hash: fe7e216771cf5ddb39044721310be721eb3c3e7965cc92aebc43f8e73964297b
Instruction Fuzzy Hash: D2A11C34B102198FCB14DF24C994BA9BBB6BF89300F5585A8E54AAB355DF70ED89CF40

Function 05963903 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333b0d1228c861eb3eb85992c4773476b8a0142184aade510afe3872f2a75e69
Instruction ID: a7c6c22c8b22fa67a33a3ef83f633b8b2f36d43980fce0ccc67e69061c0ddbb8
Opcode Fuzzy Hash: 333b0d1228c861eb3eb85992c4773476b8a0142184aade510afe3872f2a75e69
Instruction Fuzzy Hash: ECA15934E00519CFCF11CFA5D858AFDBBB6FB48710F148465E851B7294DB79AA0ACBA0

Function 0596E8E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7416a38b9dde1da8b8099379a07ce62696d02f8599fb100b5aee52e9774cd96b
Instruction ID: d68b1b232813b815ad2be963aee85a35e1838a942cd54a4eb6009ad551a1632f
Opcode Fuzzy Hash: 7416a38b9dde1da8b8099379a07ce62696d02f8599fb100b5aee52e9774cd96b
Instruction Fuzzy Hash: 42812A34710614DFCB14DF68D498A6EBBBABF88610F1480A9E5069B3A5CB74EC49CB90

Function 05960040 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c84ec8fe15ba8b8b5d262c525a7328530f8a09a9f577361e1449f3960af83bf
Instruction ID: e0d7d83e8f1782c29ef1ee9ef4bc520cd03271bb8fa1ff6bf686790dec095231
Opcode Fuzzy Hash: 0c84ec8fe15ba8b8b5d262c525a7328530f8a09a9f577361e1449f3960af83bf
Instruction Fuzzy Hash: C3817A35B012058FDB04DFA4D599AADBBF6FF88311F24846AE812AB390DB35ED45CB50

Function 0596E8D8 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2079257a755c871637d2710f3a9caa544028071d84c32392f57d5a5981ee05
Instruction ID: 88733da82af92dbb906de14c872bbb0435d03f5517f302d1cc19db85861b57ab
Opcode Fuzzy Hash: 4c2079257a755c871637d2710f3a9caa544028071d84c32392f57d5a5981ee05
Instruction Fuzzy Hash: 5A611C34B10614DFCB14DF68D898A6EBBBAFF88710F148169E8069B365DB30EC45CB90

Function 059602F8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8f1af9efb82d2684cd0e8ae81ae0ae4be12292f7f2948dd0f315a3c2d5a33c
Instruction ID: 4a66c2a0aff6360c8150c19b0aa42da8e07881afd205351910c295dd709d53f6
Opcode Fuzzy Hash: 6b8f1af9efb82d2684cd0e8ae81ae0ae4be12292f7f2948dd0f315a3c2d5a33c
Instruction Fuzzy Hash: 8E51AF35B04205DFC724DB69D898B6ABBB6FF84314F14C46AE916DB350DB31E84ACB90

Function 059697D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0be6989392d09f3483f3866799d628a7abc890e577deebdfba334a1740d00b
Instruction ID: 1de78da2a0ba08b2a9a23d62f1cbbccb667c41d717f1d7f6ccb81ed255af7b06
Opcode Fuzzy Hash: db0be6989392d09f3483f3866799d628a7abc890e577deebdfba334a1740d00b
Instruction Fuzzy Hash: B1515F34B10609DFCB15EF64E458AAEBB76FF88711F008119F9129B364DF74A906CB91

Function 05989288 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c551bb6ed24de8dfb9d59cdfd7eefc95c65cef66ac6e173638e1f8bf8320a3
Instruction ID: d03bb5ec16f871dabfb40db623c48de6a5d76d08ce5384b62dfd43aae5227e33
Opcode Fuzzy Hash: 19c551bb6ed24de8dfb9d59cdfd7eefc95c65cef66ac6e173638e1f8bf8320a3
Instruction Fuzzy Hash: 7A418E347081028BD705BB68E058B7F36E7F7D8715F9084B9D9069BB88DF39AD428B85

Function 05989278 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a09264747cd87db85093e920616a60ff2f52d572842111c7e0381b913d78cc1
Instruction ID: 0da12b232368895a99f6e100592f19540d6ebb1ae82caa96fccff1703fe77537
Opcode Fuzzy Hash: 4a09264747cd87db85093e920616a60ff2f52d572842111c7e0381b913d78cc1
Instruction Fuzzy Hash: FA418E347081028BD705FB68E058B7F36E3F7D8315F9084B9D9029BB88DB39AD428B85

Function 059892CB Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d40761dc037e05f5f2d10dd3ec4567a9c791ddede14a5f17df5fc238036504
Instruction ID: 1134e9f18bbc44eec514d6eb0b7f1c7f15cfa38db8e457442d842571f07ba119
Opcode Fuzzy Hash: 52d40761dc037e05f5f2d10dd3ec4567a9c791ddede14a5f17df5fc238036504
Instruction Fuzzy Hash: 7D419D343181028BD705BB68E068B7F36A3F7D8715F9588B9D9025BB98CF79AC428B45

Function 05989DB8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5caf5dadd7b899542ac4408a548a7a5ef696467975ad20c8dbdca1d8b4a4b7
Instruction ID: e1a50da9cd7cff705bdb55bda0f3c0b9235f80fb9f5da7117f90e1dfd9941255
Opcode Fuzzy Hash: 3f5caf5dadd7b899542ac4408a548a7a5ef696467975ad20c8dbdca1d8b4a4b7
Instruction Fuzzy Hash: 93418A71B04205CFDB14EF68D584BBABBB6FB88310F1284BAE5098B659D770EC41CB95

Function 0596BAF8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e216dafda1b9495eae4a4535710be89983b1e1387c4256b94cbe956555b8162d
Instruction ID: 02422b48f18247d4072983faa6ca58f378423285f24b893338c8d007d3d9532a
Opcode Fuzzy Hash: e216dafda1b9495eae4a4535710be89983b1e1387c4256b94cbe956555b8162d
Instruction Fuzzy Hash: 1D31D7366101049FCB05DF68D998EA9BBB6FF48320B1680B9F9099B372DB31ED55DB40

Function 059604E3 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694beb52e6f7a698b04d43c7ad8d6c4e6d7708150d151a7b38a61d607071fa6f
Instruction ID: e12d383307acaf7e1f48afe74214779540f5e3a4f932b5076e489adbae23dd35
Opcode Fuzzy Hash: 694beb52e6f7a698b04d43c7ad8d6c4e6d7708150d151a7b38a61d607071fa6f
Instruction Fuzzy Hash: 84418971A00216CFCB14CF6AC988AAEBBB5FF88310F508439E406E72A1D734D949CB90

Function 0596EBF8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b114d4ae5ae586b142436a958b4052f44c2b044eb937680b9ee8d974d2c33928
Instruction ID: 8e4fc8657c6a409f3381a2d341e4dbc8a4e61e81b96a24d672934f05a08fdcbd
Opcode Fuzzy Hash: b114d4ae5ae586b142436a958b4052f44c2b044eb937680b9ee8d974d2c33928
Instruction Fuzzy Hash: 24312E39A00119DFDB14DF65D854AEEB7B9FF88310F108025E815BB394DB75AD09DBA0

Function 0598A3C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1af0e716c592f801fee6accb627443a44c1aaefa4887e895fbc0e1746ed423
Instruction ID: d97577115438a06d7f817eac66628a8ddcddbf76aca44bf0cea65b26ab9f9bc0
Opcode Fuzzy Hash: 4b1af0e716c592f801fee6accb627443a44c1aaefa4887e895fbc0e1746ed423
Instruction Fuzzy Hash: 7F314631A09354CFD710AB38E94D7327BE9EB41320F4981B7E4959B781E725DC01CBA6

Function 05962E58 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19dd4bff100cbac5c8ec75b5efcf8d5f633cfd00dfc9f338e10afbfa4f3307e
Instruction ID: cafbfa459ade0ff586b60062f7b0180e96f057e243135db7fa6fcb6e51fae590
Opcode Fuzzy Hash: a19dd4bff100cbac5c8ec75b5efcf8d5f633cfd00dfc9f338e10afbfa4f3307e
Instruction Fuzzy Hash: 70316E387003029FC725AF25D44896ABBBAFF85355B60886DEC168B364DF71E84ACB50

Function 0596A570 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147639bef08296266c45d6d1cc08845181280c0cb4158ff1aab7fd13397b70c4
Instruction ID: d62ee6ea560a0d01c41d0745c8b02536a6ec78e9866fa0d35b559b5550f9c27f
Opcode Fuzzy Hash: 147639bef08296266c45d6d1cc08845181280c0cb4158ff1aab7fd13397b70c4
Instruction Fuzzy Hash: DA21B331305640CFD324CA6EE98492ABBE9FF81321B55C07AE50EDB251DB35EC49C751

Function 0598E4A8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6971f4ff5497f8faba04faf2cdc4d2d608646168e68f6f226c1ba931d2bd519
Instruction ID: 5dd24c90b620c76938547477fc5b7ec5660f0d62de20135cf2e82e3e444c0829
Opcode Fuzzy Hash: f6971f4ff5497f8faba04faf2cdc4d2d608646168e68f6f226c1ba931d2bd519
Instruction Fuzzy Hash: F2318B30B04004CFDB14EB2CE469BBA77EBFB88311F2980B5E40997694DBB46D89CB55

Function 0596CBD0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bc0f51e18baba5309509e15737e38254345f22874375491cb1f2b8ae65d172
Instruction ID: a7724215142676ea260db534c377b75cfea2645e2c2bb7cddab68abb1c6454b7
Opcode Fuzzy Hash: 34bc0f51e18baba5309509e15737e38254345f22874375491cb1f2b8ae65d172
Instruction Fuzzy Hash: C2214674B10919CFCB00EF68C5548AEB7F5FFC9700B50456AE506A7354EF74AA0ACBA1

Function 015AD1D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2581998707.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15ad000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f10242fd7ead7a2220f8e55cbef977b15532e567d960de35991d54c27deef27
Instruction ID: eac93ff2e7f8dbb5c66b9bde9bab46c156ef984d535e331b0420345ea0fa4166
Opcode Fuzzy Hash: 9f10242fd7ead7a2220f8e55cbef977b15532e567d960de35991d54c27deef27
Instruction Fuzzy Hash: 28210271544200DFCB05AF84D980B2EBFB5FB88320F60C569E9090F656C336D416CBA1

Function 05962D30 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbc769f57c9f4e4bca3a4d0663cb9e483de80fd3885ddd1641a39a5b348a86
Instruction ID: 05cc6f1b39c9f141bfc4e77f6356260aa642dd430f87645fce9c1c09ec515069
Opcode Fuzzy Hash: 52dbc769f57c9f4e4bca3a4d0663cb9e483de80fd3885ddd1641a39a5b348a86
Instruction Fuzzy Hash: 33215779A00219DFDF50DBB8C914BEEBBF9AB44350F108466D919DB2A0E634CA58CB91

Function 0596BAE8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7448209bc1c0759e986da19acbad1c196501bc2e56beb9b1474fcc92f6aa58
Instruction ID: 5e6ca11c15acdc6750562f6ba9264d2572410f4a2ddd4976e7eb68058b6f1471
Opcode Fuzzy Hash: db7448209bc1c0759e986da19acbad1c196501bc2e56beb9b1474fcc92f6aa58
Instruction Fuzzy Hash: AD210876A001049FCB09CFA8D998E99BBB6FF49311F0684A9F6099B372D771EC15DB40

Function 05967E10 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931e861ccce505ac0a33879fdb01d9d8c9ee77ec178f7453af8c4eb7233942cf
Instruction ID: c8b7db06e5307653baad19ead20d403823c9c27c58c582e15fcc0edfd568b732
Opcode Fuzzy Hash: 931e861ccce505ac0a33879fdb01d9d8c9ee77ec178f7453af8c4eb7233942cf
Instruction Fuzzy Hash: 0E210831A00209CFCB05DF94C644ADDBBF2FF88315F6045A5E405AB361DB75AD49CBA0

Function 0598F538 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd472ec8cf60593b2372c57d56a5b21b4c3f5c6e21f8767957dd6efe2878fb8
Instruction ID: 38ba1180d558af54ec0afd2c0f6085b40b29cede185e687a22ab4db93610bde5
Opcode Fuzzy Hash: 0cd472ec8cf60593b2372c57d56a5b21b4c3f5c6e21f8767957dd6efe2878fb8
Instruction Fuzzy Hash: 97213A31A001089FCB159FA9C4589EEBFB6FB8C320F249129E911A73A4DE719845CF90

Function 059604F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9093e69ab8c9d266241390c1d78e8153c660b659470e6d1b9ab44a4ca120c5fe
Instruction ID: 92f71c27ff5b0d6635d05f75bec4822425b303d00c64cc15699876aeccddc552
Opcode Fuzzy Hash: 9093e69ab8c9d266241390c1d78e8153c660b659470e6d1b9ab44a4ca120c5fe
Instruction Fuzzy Hash: 46216F75A00216CFCB14CF6AD988A6FBBF6FF88250F408539D906A7351E734E845CB90

Function 0596CBC3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742b0db3f89bbf91e9f0a3ff54a6e388adecc74f19dc28e8ab6174bdfbeae25c
Instruction ID: 6affc1d4e1f6f133c1fe295b12b5296ed5152a98c54986867802f508a3e20ee7
Opcode Fuzzy Hash: 742b0db3f89bbf91e9f0a3ff54a6e388adecc74f19dc28e8ab6174bdfbeae25c
Instruction Fuzzy Hash: 1B215474B00909CFCB00EF68C5949AEB7F5FF89700F10456AE506A7360DB75AE0ACB91

Function 05967E00 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b035f1f9a89888be427d4c6fb1db35471037a53cd4455635bbb8dba413245d8
Instruction ID: e39b0767b5c689354852d4ee52e09edc0f3765659fce8ad15a6f834f9ff9163c
Opcode Fuzzy Hash: 6b035f1f9a89888be427d4c6fb1db35471037a53cd4455635bbb8dba413245d8
Instruction Fuzzy Hash: C4212B35A00209CFDB09DFA4C655A9DBBF2FF88301F6045A9D401AB2A1DB75AD49CB60

Function 05968B00 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7521b0628853370bd2c2502efb698e4152125318be6e145caa3ec439c59eaa6
Instruction ID: 3033b60448f70207d18cffb01d485db7d2f6ada5845cf5fb6cb6bbbfde844ab9
Opcode Fuzzy Hash: d7521b0628853370bd2c2502efb698e4152125318be6e145caa3ec439c59eaa6
Instruction Fuzzy Hash: 5821DCB1A00616EFCB05CF68C984A6AFBB9FB44314F06856AD4059B655D370E89ACBC4

Function 015AD1D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2581998707.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_15ad000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: cb2d72f7637f7317be92692b3204d1386cfa8e32ae4dac5fbbfdaea79cf5f0eb
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: CC218C76544240DFDB16DF54D984B1ABF72FB84324F24C2AADD090A656C33AD41ACBA1

Function 0596A120 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdb81b0b5d01e65b92588baf7c435dbfed831bfaef80a44c8eeaa8b51c9ccf2
Instruction ID: fa511342dee7decdea96442020c8226f0728b36bb782e4ecb35ab6713dbc296a
Opcode Fuzzy Hash: 6bdb81b0b5d01e65b92588baf7c435dbfed831bfaef80a44c8eeaa8b51c9ccf2
Instruction Fuzzy Hash: 540140313111108BD714AE29E8C496ABBABFFD8665359803AE906CB365DE75DC09C790

Function 0598E350 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b9c5e87cc464e5e583f65457865c4546e812aa556e6f01375b8b2051568c4e
Instruction ID: ac752229ee92657c1538c57462ea0ad5db0593826a613fee9b858e836c48688b
Opcode Fuzzy Hash: e5b9c5e87cc464e5e583f65457865c4546e812aa556e6f01375b8b2051568c4e
Instruction Fuzzy Hash: C701BC713042049FD304EA69D854F2AB7EEFBC8710F61807AE50ACB760CA71EC418744

Function 05965968 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05790010098d647803ca81b0fb867dec5abe339107ad5e5fc2f88b59901edf8
Instruction ID: b08657b829ffad198d178d842e14b956afa66fea7d1dfa25b55bc006142457f7
Opcode Fuzzy Hash: d05790010098d647803ca81b0fb867dec5abe339107ad5e5fc2f88b59901edf8
Instruction Fuzzy Hash: 7601ADB6A0021CAFDB15DF99D840CDEBBFDFF89310B058166E915E7310EA30A905CBA0

Function 0596ED3B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5885284ed53b4ddfdf4ce171a31f1a593dae7ccbe26cc892e6d9db5e52126f93
Instruction ID: 818e86e21b799932122db3baf57425ebf5f3cd2ca41907af082e6fae06ca152e
Opcode Fuzzy Hash: 5885284ed53b4ddfdf4ce171a31f1a593dae7ccbe26cc892e6d9db5e52126f93
Instruction Fuzzy Hash: 9901DE343003049FC725AA35C858B3B3BAAEBC5310F148929E5528B390CB75EC46DB80

Function 0596ED48 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6103fadc81fd2faa7058915069bc4eacfc8618f9fe8664cf50df1ed3839ff97
Instruction ID: 63d7b91937d26e657086e1877fe133320a58a2b3a4100a4ef15a7cb8ad5623e3
Opcode Fuzzy Hash: e6103fadc81fd2faa7058915069bc4eacfc8618f9fe8664cf50df1ed3839ff97
Instruction Fuzzy Hash: 3C01BC383007049FC725AA25C558A3B7BBBFBC9320F148928E5564B790CB75EC46DB80

Function 0596C2B1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b29ed3e99a8397ecabe07f151d8fa0a7c98790df27ffd83af0c56af7f135d5d
Instruction ID: 4ebcf56b8629fddf4d3be2e1a9d26086f6e5298290db56decb503d05267da9a7
Opcode Fuzzy Hash: 7b29ed3e99a8397ecabe07f151d8fa0a7c98790df27ffd83af0c56af7f135d5d
Instruction Fuzzy Hash: 33018C363112049FC7159F59E844E7A7BA6FFC9722F0480AAFA45CB360CA31EC02CB91

Function 059697C0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61a0715553496aec4a1e15301d8644531e1d25331d0d79106bc9cd50057603d
Instruction ID: 517dbd7d263d4e24ac897b8463f31132379493ef1f70791f2d892b1b5468be64
Opcode Fuzzy Hash: b61a0715553496aec4a1e15301d8644531e1d25331d0d79106bc9cd50057603d
Instruction Fuzzy Hash: 8FF02437B101096FDB189A19D8549AEB7AAFFC8220F448036FD29D7360EF709C0A87D0

Function 0596C538 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9261b3afe63796fbd7b8c8bbccefb7ad9b2a790e0a39ea34ab89a2114124ec4e
Instruction ID: a0c69610dbfb98f65fa1aa1b4fff1b6903bd5207a72ea4079da4d3d1f1d886fd
Opcode Fuzzy Hash: 9261b3afe63796fbd7b8c8bbccefb7ad9b2a790e0a39ea34ab89a2114124ec4e
Instruction Fuzzy Hash: 57013139300A14DFC3199B25D15895E7BA6EFCD711B108168E91A8B7A4DFB5EC43CBD0

Function 0596C52B Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab857595b18cd1935bd2d96fda4cb1d71a5b0223f1c528870461457a6c6823d7
Instruction ID: 2ec2c7053e225c8d680536884a820001a3d4db784f17d9e027f7fe8a7d5fc340
Opcode Fuzzy Hash: ab857595b18cd1935bd2d96fda4cb1d71a5b0223f1c528870461457a6c6823d7
Instruction Fuzzy Hash: B90162393009108FC3199B24D159A1E7BA2EFC8712F10C168ED1A8B7A4DF76EC53CB81

Function 05968BB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe0feeecfd72867f39c8957d805047d9603fd6a548401e522f3de85c14ee8c9
Instruction ID: 9ded56bba85e396edd3e0fbf2272af29fef08c3f641322f0d0b2578bc5c18469
Opcode Fuzzy Hash: ffe0feeecfd72867f39c8957d805047d9603fd6a548401e522f3de85c14ee8c9
Instruction Fuzzy Hash: BEF0E29670D2D20FD3122B3C6C64328BFA4AF87518F0802BFECD1DB393D544884A8795

Function 0598A3B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ad959bb1868348cf897463ba9c566eaf3f18e694daf7debbb81da36fd065e7
Instruction ID: 72f86793da178afee6af9c9020c1a449d88dda09a57b6f9bc8bf3a99bb762ea5
Opcode Fuzzy Hash: a9ad959bb1868348cf897463ba9c566eaf3f18e694daf7debbb81da36fd065e7
Instruction Fuzzy Hash: 65F0CD32A14210CFCB20AB65E50CB323BEDFB80230F06902AE845C7640DB60EC40CBA1

Function 0596B8D9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d00db95c66bfd8da9198f156412bf464a6ae0dd1b9810e73bf9b57e90be19a
Instruction ID: 3907fb9eae616deb4ffe7ddecb1d7bdd4dd5359b59b1f508e1d23b395ae6e5c9
Opcode Fuzzy Hash: b7d00db95c66bfd8da9198f156412bf464a6ae0dd1b9810e73bf9b57e90be19a
Instruction Fuzzy Hash: A2F090353045009FC7109A18D984DAEBBA2EFC4354B158139F919CB3B5EA71ED4A8750

Function 05984F30 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a723815392359bba134d97cc4603c17499e65a744e0227a3090e3fb5f0a2579
Instruction ID: e50759af9b8dbf00b20927ab6c0de8daeaeecac13c762bda9a4898ebf660b843
Opcode Fuzzy Hash: 6a723815392359bba134d97cc4603c17499e65a744e0227a3090e3fb5f0a2579
Instruction Fuzzy Hash: F3F0A0717403185FD7481A79281476B9A9AFBC1754F24C03EE00ADB3A5CD668C014390

Function 0596C2C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a2b33334f3cccbb5ffd9879cc6d3adb8616b998f69869885ac30b5e8b56d11
Instruction ID: 0db42943acc436c32048e1feaee01b2f636e420cb3767675a279cf2d990e53d2
Opcode Fuzzy Hash: d1a2b33334f3cccbb5ffd9879cc6d3adb8616b998f69869885ac30b5e8b56d11
Instruction Fuzzy Hash: 7CF05E353102049FC315DF19D458E2A7BAAFFC8721B148069F916CB760CA31EC02CB90

Function 05984F40 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f686dc1e7f20f79320a258a8e6c93f2d84812a42f3796172b15fdc63a81e1ca
Instruction ID: 47a4558da3eaf6b799387775fbf8cebbda0b9d2afea5ce08c56759d05271447d
Opcode Fuzzy Hash: 7f686dc1e7f20f79320a258a8e6c93f2d84812a42f3796172b15fdc63a81e1ca
Instruction Fuzzy Hash: A0E09A213403182BD3082AAE2C14B2BA98EFBC5B60F24802EA10DDB3A4CC628C0103E0

Function 05986AC3 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e39b4925397dca6f590736c2c262cef2654fed7ff58486db314a96d26df08be
Instruction ID: 153a1041e3a401ae8911ba9d176fb6d3a7d00f1c898ec807e6fe86b1e61c6e10
Opcode Fuzzy Hash: 2e39b4925397dca6f590736c2c262cef2654fed7ff58486db314a96d26df08be
Instruction Fuzzy Hash: 13F03C31A06025DBEB20EFA8C854BB873B5BB04310F0605A9C40A6B6A0C7349D88CF42

Function 05968C20 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92c8f53389f545d7a9cc15995ac6c632e9cd5351d30c762621b4c30edd496352
Instruction ID: 34283a70f1eb49d19daeadd4f2fb8aa9afc1c321f424650f321d059775f838c3
Opcode Fuzzy Hash: 92c8f53389f545d7a9cc15995ac6c632e9cd5351d30c762621b4c30edd496352
Instruction Fuzzy Hash: D2F0A0312003059FC7249B2AED8485BFFAAEFC1310704C53AE459C7226DEB0AC4A87A0

Function 05980E3C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e89a6304ab7d3f861ba22e4164b953475360ca2532fbfcdbeaa13339589feca
Instruction ID: 76023ad6b210cca27652cf2a656eb5d8be018e24b6093e18653046b91e4986f1
Opcode Fuzzy Hash: 2e89a6304ab7d3f861ba22e4164b953475360ca2532fbfcdbeaa13339589feca
Instruction Fuzzy Hash: 99F09A30E04212CBEB50EF74C8887BEBAB6BB44340F114968D807A7244EB789C0ACB91

Function 05E6657E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b1b2c047d49d402468d4d8ee7dbf15e53235384e85d7a7f00cff8de39f76fe
Instruction ID: fe9190284775b3004a3d48fc42f091a027dc88ad8cc9e4d28b75531e84d4eb35
Opcode Fuzzy Hash: 23b1b2c047d49d402468d4d8ee7dbf15e53235384e85d7a7f00cff8de39f76fe
Instruction Fuzzy Hash: B9019278A112288FD794DF28D898B8ABBB5FF8C314F5044E5D909AB355DB30AE80CF01

Function 05E6382A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0581758076c7f8732753b8db5caabfc374c9cfee57fec1628cc4f3c149be2ec5
Instruction ID: 367a58c8ba4157a486827f688a744b82e3d6e69d68a838a6719c327bb038d0c2
Opcode Fuzzy Hash: 0581758076c7f8732753b8db5caabfc374c9cfee57fec1628cc4f3c149be2ec5
Instruction Fuzzy Hash: 2E01A878A052288FC794DF18C848A8ABBF1FF88310F5494E9D949E7354DF309D848F40

Function 05E65055 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb3f7a877050eb50bd0fdb52f778271ae02a7bac91fdadf1c74387f4d458d05
Instruction ID: 18eaff04976864fe5f6e8ba3e93d94f27577e45d9106150c4ce35cc36c7b407c
Opcode Fuzzy Hash: ddb3f7a877050eb50bd0fdb52f778271ae02a7bac91fdadf1c74387f4d458d05
Instruction Fuzzy Hash: 1501C9B8A511168FD754DF18C898AAABBF5FF89310F5041E8E509EB395D7309D40CF51

Function 059616CF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564d80a89484a5c6fc61ce98b89833b7f954a4d6ea8623d626dfe044b81ba65e
Instruction ID: b180b3546848069d31f5427f68c254c98d0a566a9329fff73f1af3a2091c40da
Opcode Fuzzy Hash: 564d80a89484a5c6fc61ce98b89833b7f954a4d6ea8623d626dfe044b81ba65e
Instruction Fuzzy Hash: 9BF0E235A08A449FDB09CB64C09D7DC7FF2EF40206F1880AAD44687191DB3416C6CB45

Function 059616E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11807bb9923ee78ff405c44bddc66a8c704b1425233513b97ca50aec0c6f3b06
Instruction ID: 1927498138d36228e4b9909c7efb54bbcd362cf2ad1899e06e2337479e58bac6
Opcode Fuzzy Hash: 11807bb9923ee78ff405c44bddc66a8c704b1425233513b97ca50aec0c6f3b06
Instruction Fuzzy Hash: 5FF06535A08618AFDB19DF55D04D6DDBFFAEB84211F18C095E40693250DB742A85CB85

Function 0596A109 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d10e275f8739cf1eacd328917e004c9e9de4974a84930673c51d808377a467
Instruction ID: c260c0935cf1e1ff5ac2652eda5a7773d50e2fbb3ab13bb52d5580c6d57e361b
Opcode Fuzzy Hash: 90d10e275f8739cf1eacd328917e004c9e9de4974a84930673c51d808377a467
Instruction Fuzzy Hash: 8BE068723083808BC3128B18E8C1B053FBAAF9216174A40BFD848DB513C7348C04C360

Function 05E61BE7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadd411fc40429ca86854424d826502a6e66d2f5bf16ffbdea55f1b16e0f4dd0
Instruction ID: b48e28a7918cb1c787c4fb494a5aa3fec2fc4342e82c0765c60cfd78252a4f5c
Opcode Fuzzy Hash: cadd411fc40429ca86854424d826502a6e66d2f5bf16ffbdea55f1b16e0f4dd0
Instruction Fuzzy Hash: E2F01D74A04219CFC754DF58C49869E7BF1FB88310F5444D8D84ABB391CB30AD408F50

Function 05E67575 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f5f12716fc062d65e652c5c7a768b964340efe17a8d041193aa4a91b1d5eb4
Instruction ID: 671b86b955de43305cfe13ae9cbf47ba3e9e67a15de512a352e2e75a625e1b34
Opcode Fuzzy Hash: 85f5f12716fc062d65e652c5c7a768b964340efe17a8d041193aa4a91b1d5eb4
Instruction Fuzzy Hash: 80F09A30A08050CFDB419F68D48CB9E7BB9FB40388F8084F29C89AB282DB358E018F50

Function 0598CA52 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57550ac4ad0fa42064087139b88734fd839f2cc8a4522c6e8f81c6b6c6b28558
Instruction ID: c377fff0be2897a7754bef0b0d9bc9a1dac6ff3b99a4cd3c75eb037b7030dbd2
Opcode Fuzzy Hash: 57550ac4ad0fa42064087139b88734fd839f2cc8a4522c6e8f81c6b6c6b28558
Instruction Fuzzy Hash: 6FF03975B001018FC784EB7C90AC72E36E7BF8C215B4548A8E80EDB3A1DE35AD068B41

Function 05968C30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b446f686110880a7900a3de632cea2b5943e152206f72c3fe22a69230e92cf
Instruction ID: 3e7b2870299353ae659e3abbd570f847048520990fecb980194811877e259f86
Opcode Fuzzy Hash: e8b446f686110880a7900a3de632cea2b5943e152206f72c3fe22a69230e92cf
Instruction Fuzzy Hash: E3E012313002055FC7149A1AE984C4BFF9ADFC0264714C539A55A87225DEB0ED4A8690

Function 05986C4B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ac03bf5a1d22722b74ac6627fa97582550f6758b81852462e8ab656bb20cc9
Instruction ID: bfa30b8f15ccf5fc798b0ba946b37da572dc99c591bfdcdad434c1e7372e6c5c
Opcode Fuzzy Hash: 29ac03bf5a1d22722b74ac6627fa97582550f6758b81852462e8ab656bb20cc9
Instruction Fuzzy Hash: 2CF01C31A05214DFEB60DF98CC55BB9B776BF05304F1108E4E61A6B2A1C7319D44CF42

Function 05963068 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea0a75cbe3a695f0ff00d138c907dfb1408ead049fe4f043559026f873c7ba1
Instruction ID: d0e016dcbb4c126c5ad42681be12fce75e29e7e7da1163ff357570625a2ee128
Opcode Fuzzy Hash: 8ea0a75cbe3a695f0ff00d138c907dfb1408ead049fe4f043559026f873c7ba1
Instruction Fuzzy Hash: 73E086313543149BCE14A674584476232E95B84650F104869DB069B2C0DA72EC4DC252

Function 0598C8B4 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35d9b0f1c6c17b46e9d79b63b66808ca761cceb2e8c5049f15d48baca5948de
Instruction ID: e9d2d555bd8cf89513fe74003f4661d60c360adc36aede1fcb845c235f664d79
Opcode Fuzzy Hash: a35d9b0f1c6c17b46e9d79b63b66808ca761cceb2e8c5049f15d48baca5948de
Instruction Fuzzy Hash: 11E09230B98119CFEF10BA28E5486773767F780321F248535D9825B384EA7D8D45CB52

Function 05E626A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed28b64c3b7041debb0f665aff55ed022ea0adc9a71ff366b4c52f182d1a8b62
Instruction ID: ef12c3545028df522780572e31486607352664feb1fc2bec3b6c9cb715d592c9
Opcode Fuzzy Hash: ed28b64c3b7041debb0f665aff55ed022ea0adc9a71ff366b4c52f182d1a8b62
Instruction Fuzzy Hash: D9F0D478A182198BC795DF58D998BDEBBB5FB8C300F4045E4E509AB384CB34AD408F50

Function 0598A108 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08961a2362e531f606b861288676bddbc230d81c6cd508333a1ee4ec4ac0824b
Instruction ID: 84f498b8013a8ab0218e0f18cf7fe7d8772f2e9a713a78579c3844593f23d3fe
Opcode Fuzzy Hash: 08961a2362e531f606b861288676bddbc230d81c6cd508333a1ee4ec4ac0824b
Instruction Fuzzy Hash: 87D05E72A0520CEBCB10DEB0EE014AAB3ECEB05115B1005FA9D0EC3204FA32DE10DB90

Function 0598A0F8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606bbb3f0b1e5f217d076be5175b5ec1b5e23acae8ff81e346e9a49d81ac2814
Instruction ID: 723a35dc4edb7cad67d68b86def039332f6bb9bc25a396044ee0dfbc379ca405
Opcode Fuzzy Hash: 606bbb3f0b1e5f217d076be5175b5ec1b5e23acae8ff81e346e9a49d81ac2814
Instruction Fuzzy Hash: 44E0EC72910309EBCB10EBB1EA427AA73ECFB05218F1155AAED15C6114EB359A51AB50

Function 05E637EA Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d1bbe3e3d5bcc1eba6ac2e5071173fa8104358def4a4e8022f9017702f3502
Instruction ID: 6510834ae04772f928c3e253f8f729232c1db7170b358c9821a48f49240c9688
Opcode Fuzzy Hash: 80d1bbe3e3d5bcc1eba6ac2e5071173fa8104358def4a4e8022f9017702f3502
Instruction Fuzzy Hash: 9AF0E5B08081218FC796CF14C84C689BFF5FF45304F4490E5C84AAB289DE740E45CF50

Function 0598EA50 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f98bdbf7582dc705a493755d0433b88c6c9f5debebbbd20dc308f84a01f35b
Instruction ID: ed66ea125c3912714cd3804cc9d211a7887c750de16ac3fc09d6f2282af2b47b
Opcode Fuzzy Hash: b3f98bdbf7582dc705a493755d0433b88c6c9f5debebbbd20dc308f84a01f35b
Instruction Fuzzy Hash: 13E0C230A5020CEFDB00DFB8E9416AEB7BAFB84204F5045A8D804DB250DE716E009780

Function 05965890 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f502bf276edef464eeb37baabd4044393c1033083847dce96d27a8e5ceeb9cd0
Instruction ID: ba784e9cda5c899483404c001576a6f96c8ffcbadeffbb5c0a362f8599f9e8cb
Opcode Fuzzy Hash: f502bf276edef464eeb37baabd4044393c1033083847dce96d27a8e5ceeb9cd0
Instruction Fuzzy Hash: 9BD02B33E4221457D7311D90D903B963304BF10B70F090015EB047F384C1759800C3C0

Function 0598C632 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32948323697eb7d8b6b264546e8882030f0f6e0fb761765ae78427d62c0e645b
Instruction ID: 588e151666ef6f1550c5f99c687005bcf47281c1f3b9b4081b58be89e34f2022
Opcode Fuzzy Hash: 32948323697eb7d8b6b264546e8882030f0f6e0fb761765ae78427d62c0e645b
Instruction Fuzzy Hash: 72E0E575B18120CFEB10AB34D94D369BBB2BB44301F0408A5EC8AA3340DF74AD09CB11

Function 05982848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d118882d51bfa19610dfbd98983883001428dd5af4d2ed000ed3152f9b7bc0
Instruction ID: 52573fdb55996dd5837200efac7826584cceaeb59d8e6399e8fc852b503471b0
Opcode Fuzzy Hash: c6d118882d51bfa19610dfbd98983883001428dd5af4d2ed000ed3152f9b7bc0
Instruction Fuzzy Hash: 0CD0C9B2A842045FD384D5E9CC42B92B3A9DBA9A59F14C429E94DC7381E922ED078594

Function 0598EA08 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d254bb5eb807c4be60c14fcdb87672cb0b4fda2369c8025b881b07ba585905
Instruction ID: b1a41ae22a6e2b984fe2db583ea6d8138fa06a9281115b2db922157976ec8147
Opcode Fuzzy Hash: 00d254bb5eb807c4be60c14fcdb87672cb0b4fda2369c8025b881b07ba585905
Instruction Fuzzy Hash: 25E01230A40109EFCB40DFA8E54165EBBF9FB44214F6085A9D808D7340DA716E049791

Function 0598CCDE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ebe64cf5c48b07f982cde3e0b38bdd5ab0cb9c79bb5209b3e41b9cb7d52cf8
Instruction ID: d5b3d75f03cb786b00a18ece50af910e7e4acd4e722edbcabd2a926af4fe456c
Opcode Fuzzy Hash: 58ebe64cf5c48b07f982cde3e0b38bdd5ab0cb9c79bb5209b3e41b9cb7d52cf8
Instruction Fuzzy Hash: 14E0C232D18215CFF700EB24C80A3AEBBB2BF01320F4100B5C88763240DB385E49CA82

Function 059658A0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 587f5ea12215784d373bb7e9b07c867f2b24ed6bf825ac03b195e28b3b8c09a2
Instruction ID: 25335fdfc9133cea7a6b4fe784026e201b8aadaaf9f372f6f7a733a71171e88e
Opcode Fuzzy Hash: 587f5ea12215784d373bb7e9b07c867f2b24ed6bf825ac03b195e28b3b8c09a2
Instruction Fuzzy Hash: 5AD0C932A8632867DB315965AC06F96771DAB11BB1F454066EF046F38482B6B840C6D4

Function 05983FC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7144bebdc1bae8eeb418304ae2d704c8670bba21bb8878796a69c1e596ea6a
Instruction ID: 970896ceef1da6a9f9762e3050e58f40c05bbb8fbd8967f0c7a718cc59ea7939
Opcode Fuzzy Hash: 0b7144bebdc1bae8eeb418304ae2d704c8670bba21bb8878796a69c1e596ea6a
Instruction Fuzzy Hash: 16D05E702042085FD710CE68CC81A22BBE4DF84604B00C069BC08CB282DA32FD12CA84

Function 0596A697 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c807824b9b2cc7dd79b0cce5cd7824dc9ad144105e53ce9b5c55ee1af9cdeb
Instruction ID: c486cd3a5e1a601a1ae38ec1adea394e440fdb800b7a964d0e8d611e0d374803
Opcode Fuzzy Hash: 05c807824b9b2cc7dd79b0cce5cd7824dc9ad144105e53ce9b5c55ee1af9cdeb
Instruction Fuzzy Hash: 44D0A5B250C1854FE751D718B8013857FD1EB46200F54D5A9D44983517D730C44D4F53

Function 05985C10 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0f44170be44ebdf82f302a53145a54368983205900bde998e48a5252a8017e
Instruction ID: 1bfe2bb3a5db81defdaa32f60775a0e1648797b8008a77773c60fdbde79547f2
Opcode Fuzzy Hash: 3f0f44170be44ebdf82f302a53145a54368983205900bde998e48a5252a8017e
Instruction Fuzzy Hash: 8FD05E71A412059FC710CA50C955AA5B7B5AF95314F28C0BF940DCF252DB369903CB10

Function 059847A0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf323efb2b26cda9d1f393faabd5e9dfc949f60fb1e1804fff3c4a29a96ae12
Instruction ID: f104cc0e926302ba20b04e21e26da165eae84ccfa1108efce0c8772ae7d5743c
Opcode Fuzzy Hash: 4cf323efb2b26cda9d1f393faabd5e9dfc949f60fb1e1804fff3c4a29a96ae12
Instruction Fuzzy Hash: 89C012305492149FD300C754E903B7177D8EB40604F00C06FFD18C7501DF32A812DD86

Function 05985C20 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction ID: 58c7e918dc9fc6e739d0296992eb27fcb8a7bf4254ad48f247067e0340e6a738
Opcode Fuzzy Hash: dbcef5c395f5c673d87ed76c55c2f1c93d814102d17bdb09fc090918b690f88a
Instruction Fuzzy Hash: A6C012313402095BD304CA88C842A22B3AADBC8614B14C079A808C7746DE36EC028694

Function 0596E8B0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419cbd863c91084fd3cb144decfb812a6618aa18f4f4a3413dddf6efa314ac08
Instruction ID: e958ea7ab0ecff644da1ebedcead97a609cf24e1c62b5d2ac03f2e9228a33da2
Opcode Fuzzy Hash: 419cbd863c91084fd3cb144decfb812a6618aa18f4f4a3413dddf6efa314ac08
Instruction Fuzzy Hash: FFD0C975540208AFC300CF64E840A527FA8FB15260F108066F9048B371D731E814CB90

Function 05E66AB0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388eeca45ef714942e0020c93ddec8ee57965bf095a6815c9cc3404cf14391b9
Instruction ID: c4a3ff6066e44574e3c9bfd5b497da0e9f970fd30381a43a63d98e67db54484d
Opcode Fuzzy Hash: 388eeca45ef714942e0020c93ddec8ee57965bf095a6815c9cc3404cf14391b9
Instruction Fuzzy Hash: FCD0233C60C2014FC3019E54D05839D3E62F78C320F0400719805577D1C9241C808BA1

Function 05983FD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 05987FD0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e38797134dc2edd488034dc2ca727b5acd5d72a6940fe425340e89704b64d2
Instruction ID: a5cdbb977f078492046bb707e189f969c2590efd9605776db6bece7fa4d321ef
Opcode Fuzzy Hash: 58e38797134dc2edd488034dc2ca727b5acd5d72a6940fe425340e89704b64d2
Instruction Fuzzy Hash: CFC08C344A43048FC340CB39E886B50B7E8FF05E20F4100EAF4049B632D360E8008B00

Function 05981E10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0c832b19fb2f0de78d84116dd982c631f98cfb3f1ef4a9c57808c136cb2e45
Instruction ID: 9927be596ae257ae98320dbf440cb4cadb9b674c2224d57ae7ea9dc9d0370714
Opcode Fuzzy Hash: 9d0c832b19fb2f0de78d84116dd982c631f98cfb3f1ef4a9c57808c136cb2e45
Instruction Fuzzy Hash: 81C08CB6104B524FD300D6D0ED618A17725DB8223B358C9DBE819CB2E2E72BD9038B11

Function 059899A3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff888d44e24dc6ee4cf474760818c429811ebcc61b00eab4b0f372a2c866d14
Instruction ID: 99958d5cfcac13c938fcfe54e7db58868cf690f824a710250937d4aa72b1aa2f
Opcode Fuzzy Hash: aff888d44e24dc6ee4cf474760818c429811ebcc61b00eab4b0f372a2c866d14
Instruction Fuzzy Hash: 50C012315080084BC744DA98D882B04B368EB80218F9880A8A808CB202DA22E91A86CA

Function 05982858 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0598BBF3 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e2b1237ea6a79b49d1798f6c07dbe08f367cf83652512d2929b62a35c53876
Instruction ID: fc292a292093b73f1ccd5d8b3ed7c723a31860201d7cfe1c2ddab310fd2f3189
Opcode Fuzzy Hash: 05e2b1237ea6a79b49d1798f6c07dbe08f367cf83652512d2929b62a35c53876
Instruction Fuzzy Hash: CCC08C304083968FDB41A628ED9E99B3BA097023307990B7249F0973F9DEA40D4882C1

Function 05E6F758 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2599163640.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5e60000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 0598A88E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a057617614d731bffc7b7d38c385fd91d6fcb7ae095f705ba00b047e64712e
Instruction ID: 7ab48e8ff7ce54d94950b5317c65860d13daa7a271c3bc886d7d92db56c54df7
Opcode Fuzzy Hash: 72a057617614d731bffc7b7d38c385fd91d6fcb7ae095f705ba00b047e64712e
Instruction Fuzzy Hash: B0D0C931D04555CFEB41A665EC5C7AA7776E700321F48D671840A1B3A5CAB41D8DCF40

Function 0596C288 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cec311067daae8c447914652cc8e179ede2d38657c02c2cc191829cd311c519
Instruction ID: 205e26c7b82e1bbe9cc2e5f38d4ec3ad02ae885c91d5c9f4c1d6f8d322e76907
Opcode Fuzzy Hash: 9cec311067daae8c447914652cc8e179ede2d38657c02c2cc191829cd311c519
Instruction Fuzzy Hash: BBC012D784C3C00FC306875499155D13F900B56236B2E44D3A448D7052D1B88825C711

Function 059847B0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05981E20 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 05962D01 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edc503db52c2f5c8ed6956d367c9b32a0bd30552a0579f4cc3ed6694595e814
Instruction ID: 5ea034eecadf7d13a9d095bcaeb0d467416474336a0f44967f801a52decbe805
Opcode Fuzzy Hash: 7edc503db52c2f5c8ed6956d367c9b32a0bd30552a0579f4cc3ed6694595e814
Instruction Fuzzy Hash: 4EC04C708146189EE7019F15D50EB19BFA5F750701F408F2AB81087124DF302810DA44

Function 0596C298 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05987FE0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction ID: af14b32d06bfd8e92815529896dff630b38b90272e27f9beac44e936733b2af8
Opcode Fuzzy Hash: 1589308a74f8af7f7bdb0c60d33cff9135f67ec66d9f85fd8a52d118178258ca
Instruction Fuzzy Hash: 8FB092301602088F82409A59D444C0073ACAF08A1434100D0E1088B632C621F8008A40

Function 05985E73 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6f725f6185a86c7c4ffa7a155e4bd114073c44f28105c8df936b79e78f418d
Instruction ID: 555d2e19df10f9c8ce6e008acb19fdde9fb1fa0926c7d7a03911921c5aa6cc0f
Opcode Fuzzy Hash: 8c6f725f6185a86c7c4ffa7a155e4bd114073c44f28105c8df936b79e78f418d
Instruction Fuzzy Hash: 38C04C34B160598BFF54EB14CD50FADB671EB54200F4046E5C11EA7290C974ADC58F14

Function 0598A0AF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d87b991f9d51a63b1cf3833a3efe0bccd9a43a17aa35704ac6e69ffd98f441
Instruction ID: 07aa4d8a1ffd31d03a64fbce9da6912adb9d6676b8eee1d84b3c5783de5ac3c2
Opcode Fuzzy Hash: 45d87b991f9d51a63b1cf3833a3efe0bccd9a43a17aa35704ac6e69ffd98f441
Instruction Fuzzy Hash: 3AB09277A00019868A00D688E4404DCBB30DA98232F404032C204620008620157A9660

Function 0598E200 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9ca73973cac35940d19ae2ab0a9156106aef8e25194c670a5bdee106eb184c
Instruction ID: b365e695b9de2f9277b6a3191e27ef4676b6aa612ac78d91362e9dc1197c8095
Opcode Fuzzy Hash: 9e9ca73973cac35940d19ae2ab0a9156106aef8e25194c670a5bdee106eb184c
Instruction Fuzzy Hash: ECA02230002B0CC2A2023AB82800020338C08A222C3C000B8CA0C08B228833E2A0C08A

Function 0596A680 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a73b9bf39f3f4f2627e60304d7b585f94a23ad89ea8b75eb1a1e67bb50f912d
Instruction ID: ff95ad952cdd58ae48a9a49f5c44e232250b18a6b0d76a7ab7d22c8028c4c270
Opcode Fuzzy Hash: 2a73b9bf39f3f4f2627e60304d7b585f94a23ad89ea8b75eb1a1e67bb50f912d
Instruction Fuzzy Hash: 1EB002FC9307014ADB557F7458193443FA2F7D0144FD05D55D8509E120EB38D415AB21

Function 0598E240 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5237c59913d7c7a785063b574d577a5250e824274cb2e92f86d08b6fcd862f60
Instruction ID: f6acb9783366300896faa732c5112fc4017d4165ef209a05e46fe6b85418f2f2
Opcode Fuzzy Hash: 5237c59913d7c7a785063b574d577a5250e824274cb2e92f86d08b6fcd862f60
Instruction Fuzzy Hash: 8A90023115864CCB4A403796741A555BB6C99445557804591B90D915025E65781049A5

Non-executed Functions

Function 05982880 Relevance: 6.3, Strings: 5, Instructions: 59COMMON

Download Yara Rule

Strings

(okq, xrefs: 05982B63
\skq, xrefs: 059829EA
(okq, xrefs: 059829FA
\skq, xrefs: 05982E35
(okq, xrefs: 05982A06

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$\skq$\skq
API String ID: 0-514126368
Opcode ID: d826809d556c0c327962a4b34145f86bfa18c635d70afb28c6a77f47a75fdb0c
Instruction ID: 694927d50a6e166b9fe467f6d92efa0952d0cd309710394a63eb799d326e80cd
Opcode Fuzzy Hash: d826809d556c0c327962a4b34145f86bfa18c635d70afb28c6a77f47a75fdb0c
Instruction Fuzzy Hash: B811E9347441498BCF306F6EC58463A6A9B7BC8310F780839D90ACB3D4DA79CC458352

Function 05982A30 Relevance: 6.3, Strings: 5, Instructions: 56COMMON

Download Yara Rule

Strings

\skq, xrefs: 059829EA
(okq, xrefs: 059829FA
\skq, xrefs: 05982A30
(okq, xrefs: 05982A55
(okq, xrefs: 05982A45

Memory Dump Source

Source File: 0000000A.00000002.2597961221.0000000005980000.00000040.00000800.00020000.00000000.sdmp, Offset: 05980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5980000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$\skq$\skq
API String ID: 0-514126368
Opcode ID: 7f7cba6d72845f62c76074219f5264906c21679cad6478c1c1f74fc462f0bb23
Instruction ID: a6940992510477408a87e6fab42d3ba88422162dd9c1b2f5ba5cfa748d455ae1
Opcode Fuzzy Hash: 7f7cba6d72845f62c76074219f5264906c21679cad6478c1c1f74fc462f0bb23
Instruction Fuzzy Hash: 15116038644006CFCF20EF68C294A3E77ABBF84300B690469D9069B2E0DB75DD05CB52

Function 0596CCB0 Relevance: 5.2, Strings: 4, Instructions: 184COMMON

Download Yara Rule

Strings

(_kq, xrefs: 0596D3F1
(_kq, xrefs: 0596D3BB
(_kq, xrefs: 0596D36B
(_kq, xrefs: 0596D375

Memory Dump Source

Source File: 0000000A.00000002.2597811203.0000000005960000.00000040.00000800.00020000.00000000.sdmp, Offset: 05960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_5960000_2fdda55cb5.jbxd

Similarity

API ID:
String ID: (_kq$(_kq$(_kq$(_kq
API String ID: 0-3111510350
Opcode ID: 1503bdb63078c35b637d71b0bfc0300508176f42676b5000e0d892b954b51a69
Instruction ID: d1a8fdf795b099b4d6d08e80ca429ec1b83f4961457afee5c23c71fee3b6d6c6
Opcode Fuzzy Hash: 1503bdb63078c35b637d71b0bfc0300508176f42676b5000e0d892b954b51a69
Instruction Fuzzy Hash: 2E61B175B00204CFC714DF68D49496EBBB6FF89314B608469E906AB3A5DF35EC46CB90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCAAEGD

C:\ProgramData\BAEBGCFIEHCFIDGCAAFB

C:\ProgramData\CFCFCAAAAFBAKEBFBAKK (copy)

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2fdda55cb5.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre